diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml index 0746d33835..7f36eec3fa 100644 --- a/detections/endpoint/detect_remote_access_software_usage_file.yml +++ b/detections/endpoint/detect_remote_access_software_usage_file.yml @@ -1,9 +1,9 @@ name: Detect Remote Access Software Usage File id: 3bf5541a-6a45-4fdc-b01d-59b899fff961 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | @@ -21,31 +21,48 @@ search: | count min(_time) as firstTime, max(_time) as lastTime values(Filesystem.file_path) as file_path - from datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ( - "*.app", - "*.exe", - "*.msi", - "*.pkg", - "*echoware.dll", - "*Idrive.*", - "*rdp2tcp.py" - ) - by Filesystem.action Filesystem.dest Filesystem.file_access_time + FROM datamodel=Endpoint.Filesystem + WHERE + [ + | inputlookup remote_access_software + | search file_name!="" + | rename file_name as Filesystem.file_name + | table Filesystem.file_name + ] + OR + [ + | inputlookup remote_access_software + | search file_path!="" + | rename file_path as Filesystem.file_path + | table Filesystem.file_path + ] + + BY Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path Filesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id Filesystem.user Filesystem.vendor_product + | `drop_dm_object_name(Filesystem)` + + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | lookup local=t remote_access_software file_path OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Filesystem)` - | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_file_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to + provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest + logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate + Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Filesystem` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The + "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" + that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -68,11 +85,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$. + message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A file for known a remote access software [$file_name$] was created on $dest$ by $user$. + message: A file [$file_name$] known to be associated with a remote access software [$signature$] was created on [$dest$] by [$user$]. threat_objects: - field: file_name type: file_name diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml index b7e8eb806b..01d475a586 100644 --- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml +++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml @@ -1,30 +1,49 @@ name: Detect Remote Access Software Usage FileInfo id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454 -version: 16 +version: 17 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects the execution of processes with file or code signing attributes from known remote access software within the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further compromise of the network. +description: |- + The following analytic detects the execution of processes with file or code signing attributes from known remote access software within + the environment. It leverages Sysmon EventCode 1 data and cross-references a lookup table of remote access utilities such as AnyDesk, + GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these tools to maintain unauthorized remote access. + If confirmed malicious, this could allow attackers to persist in the environment, potentially leading to data exfiltration or further + compromise of the network. data_source: - Sysmon EventID 1 search: |- `sysmon` EventCode=1 - | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product - BY action dest original_file_name - parent_process parent_process_exec parent_process_guid - parent_process_id parent_process_name parent_process_path - process process_exec process_guid - process_hash process_id process_integrity_level - process_name process_path user - user_id vendor_product - | lookup local=t remote_access_software remote_utility_fileinfo AS Product OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = True - | `remote_access_software_usage_exceptions` - | `detect_remote_access_software_usage_fileinfo_filter` -how_to_implement: This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + [ + | inputlookup remote_access_software + | search file_info!="" + | rename file_info as Product + | table Product + ] + + | stats count min(_time) as firstTime max(_time) as lastTime, values(Company) as Company values(Product) as Product + BY action dest original_file_name + parent_process parent_process_exec parent_process_guid + parent_process_id parent_process_name parent_process_path + process process_exec process_guid + process_hash process_id process_integrity_level + process_name process_path user + user_id vendor_product + | lookup local=t remote_access_software file_info as Product OUTPUT app as signature, category, reference, description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_fileinfo_filter` +how_to_implement: |- + This analytic relies on Sysmon to be properly installed and utilized in the environment. Ensure that proper logging is setup for + Sysmon and data is being ingested into Splunk. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a + KVStore collection named "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -47,11 +66,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A file attributes for known a remote access software [$process_name$] was detected on $dest$ + message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A file attributes for known a remote access software [$process_name$] was detected on $dest$ + message: Known remote access software [$signature$] was observed through file attributes of [$process_name$] process on [$dest$] by [$user$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml index b579e35a22..a2774c21a5 100644 --- a/detections/endpoint/detect_remote_access_software_usage_process.yml +++ b/detections/endpoint/detect_remote_access_software_usage_process.yml @@ -1,35 +1,62 @@ name: Detect Remote Access Software Usage Process id: ffd5e001-2e34-48f4-97a2-26dc4bb08178 -version: 18 +version: 19 creation_date: '2024-03-06' -modification_date: '2026-10-09' -author: Steven Dick, Sebastian Wurl, Splunk Community +modification_date: '2026-10-08' +author: Steven Dick, Sebastian Wurl, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security. +description: |- + The following analytic detects the execution of known remote access software within the environment. It leverages data from + Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. + We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity + is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized + access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional + malware, posing a severe threat to the organization's security. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 search: | - | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.parent_process) as parent_process - from datamodel=Endpoint.Processes - where - [| inputlookup remote_access_software where isutility=TRUE - | rename remote_utility AS Processes.process_name - | fields Processes.process_name] + | tstats `security_content_summariesonly` + count min(_time) as firstTime max(_time) as lastTime + values(Processes.parent_process) as parent_process + FROM datamodel=Endpoint.Processes + WHERE + [ + | inputlookup remote_access_software + | search file_name!="" + | rename file_name as Processes.process_name + | table Processes.process_name + ] + AND Processes.dest!="unknown" AND Processes.user!="unknown" - by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product + + BY Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec + Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path + Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id + Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id + Processes.vendor_product + | `drop_dm_object_name(Processes)` + + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name(Processes)` - | lookup local=t remote_access_software remote_utility AS process_name OUTPUT isutility description AS signature comment_reference AS desc category - | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_process_filter` -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, + and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology + Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common + Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities + lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -63,11 +90,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process for a known remote access software $process_name$ was identified on $dest$. + message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$]. - field: user type: user score: 20 - message: A process for a known remote access software $process_name$ was identified on $dest$. + message: A process [$process_name$] for a known remote access software [$signature$] was identified on [$dest$] by [$user$]. threat_objects: - field: process_name type: process_name diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml index f000f5d3d4..37d38d1549 100644 --- a/detections/endpoint/detect_remote_access_software_usage_registry.yml +++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml @@ -1,17 +1,76 @@ name: Detect Remote Access Software Usage Registry id: 33804986-25dd-43cf-bb6b-dc14956c7cbc -version: 14 +version: 15 creation_date: '2024-12-28' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. +description: |- + The following analytic detects when a known remote access software is added to common persistence locations on a device within + the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup + include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others. data_source: - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` latest(Registry.process_guid) as process_guid count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath")) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rex field=registry_value_data "(\")?.+\\\(?[^\"=]+\.[^\" ]{1,5})(\")?" | rex field=registry_value_data "(?[^\.]+\.[^\" ]{1,5}$)" | eval file_name = coalesce(file_name_1,file_name_2) | lookup local=t remote_access_software remote_utility AS file_name OUTPUT isutility, description as signature, comment_reference as desc, category | search isutility = TRUE | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_registry_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +search: |- + | tstats `security_content_summariesonly` + latest(Registry.process_guid) as process_guid + count + min(_time) as firstTime + max(_time) as lastTime + + FROM datamodel=Endpoint.Registry + WHERE + ( + Registry.registry_path="*\\Microsoft\\Windows\\CurrentVersion\\Run*" + OR (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" AND Registry.registry_value_name="ImagePath") + ) + + ( + [ + | inputlookup remote_access_software + | search file_name!="" + | eval file_name="*".file_name."*" + | rex mode=sed field=file_name "s/\*\*/\*/g" + | rename file_name as Registry.registry_value_data + | table Registry.registry_value_data + ] + OR + [ + | inputlookup remote_access_software + | search file_path!="" + | eval file_path="*".file_path."*" + | rex mode=sed field=file_path "s/\*\*/\*/g" + | rename file_path as Registry.registry_value_data + | table Registry.registry_value_data + ] + ) + + BY Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive + Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name + Registry.registry_value_type Registry.status Registry.user Registry.vendor_product + | `drop_dm_object_name(Registry)` + + | rex field=registry_value_data "[\\\b](?[^\\\/\'\"]+\.\w{2,5})\b" + | rex field=registry_value_data "(?\w\:[\\](?:[^\\\/\'\"]+\\)+[^\\\/\'\"]+\.\w{2,5})\b" + | lookup local=t remote_access_software file_name OUTPUT app as signature, category, reference, description + | lookup local=t remote_access_software file_path OUTPUT app as signature, category, reference, description + + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `remote_access_software_usage_exceptions` + | `detect_remote_access_software_usage_registry_filter` +how_to_implement: |- + The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed + to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must + ingest logs that contain the file path, file name, and the user that created the file. These logs must be processed using + the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Registry` + node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up + the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore + collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + Known or approved applications used by the organization or usage of built-in functions. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -34,11 +93,11 @@ intermediate_findings: - field: dest type: system score: 20 - message: A process for a known remote access software [$signature$] was detected on $dest$ + message: Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$]. - field: user type: user score: 20 - message: A process for a known remote access software [$signature$] was detected on $dest$ + message: Known remote access software [$signature$] was detected on [$dest$] by [$user$], via the registry path [$registry_path$]. threat_objects: - field: registry_path type: registry_path diff --git a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml index e107f64a16..63768b8e30 100644 --- a/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml +++ b/detections/network/cisco_secure_firewall___communication_over_suspicious_ports.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Communication Over Suspicious Ports id: d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3 -version: 8 +version: 9 creation_date: '2025-04-03' -modification_date: '2026-05-13' +modification_date: '2026-10-08' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -11,7 +11,18 @@ description: | data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | - `cisco_secure_firewall` EventType=ConnectionEvent dest_port IN ("888", "999", "2200", "2222", "4000", "4444", "6789", "8531", "50501", "51820") | fillnull value="unknown" url + `cisco_secure_firewall` EventType=ConnectionEvent dest_port>1024 dest_port<49151 + | where ( + ```Same digit ports, i.e 4444, 55555``` + (isint(dest_port/1111) AND dest_port<10000) + OR isint(dest_port/11111) + ```Ports with sequentially increasing digits, i.e 1234, 12345``` + OR (isint((dest_port-123)/1111) AND dest_port<7000) + OR isint((dest_port-1234)/11111) + ```Ports with sequentially decreasing digits, i.e 4321``` + OR (isint((dest_port+123)/1111) AND dest_port>4000 AND dest_port<10000) + ) + | fillnull value="unknown" url | stats min(_time) as firstTime max(_time) as lastTime values(src_port) as src_port values(url) as url diff --git a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml index d485b736f6..5b4af6d6e7 100644 --- a/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml +++ b/detections/network/cisco_secure_firewall___connection_to_file_sharing_domain.yml @@ -1,8 +1,8 @@ name: Cisco Secure Firewall - Connection to File Sharing Domain id: f7e5e792-d907-46c1-a58e-4ff974dc462a -version: 10 +version: 11 creation_date: '2025-04-03' -modification_date: '2026-05-13' +modification_date: '2026-10-08' author: Nasreddine Bencherchali, Splunk status: production type: Anomaly @@ -10,8 +10,15 @@ description: | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. It leverages Cisco Secure Firewall Threat Defense logs and focuses on allowed connections (action=Allow) where the url field matches a list of known data hosting or temporary storage services. While many of these platforms serve legitimate purposes, they are frequently leveraged by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. This analytic is valuable for identifying potential abuse of legitimate infrastructure as part of an attacker's kill chain. If confirmed malicious, this activity may indicate tool staging, credential dumping, or outbound data leaks over HTTP(S). data_source: - Cisco Secure Firewall Threat Defense Connection Event -search: | - `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") EventType=ConnectionEvent url IN ("*//objects.githubusercontent.com*", "*anonfiles.com*", "*cdn.discordapp.com*", "*ddns.net*", "*dl.dropboxusercontent.com*", "*ghostbin.co*", "*glitch.me*", "*gofile.io*", "*hastebin.com*", "*mediafire.com*", "*mega.nz*", "*onrender.com*", "*pages.dev*", "*paste.ee*", "*pastebin.com*", "*pastebin.pl*", "*pastetext.net*", "*privatlab.com*", "*privatlab.net*", "*send.exploit.in*", "*sendspace.com*", "*storage.googleapis.com*", "*storjshare.io*", "*supabase.co*", "*temp.sh*", "*transfer.sh*", "*trycloudflare.com*", "*ufile.io*", "*w3spaces.com*", "*workers.dev*") +search: |- + `cisco_secure_firewall` action IN ("Trust", "Allow", "allowed") EventType=ConnectionEvent + [ + | inputlookup filesharing_domains_lookup + | table domain + | rename domain as url + ] + | lookup local=t filesharing_domains_lookup domain as url OUTPUT description + | where match(url, "(?i)\b".description."\b") | stats count min(_time) as firstTime max(_time) as lastTime Values(src_port) as src_port Values(dest) as dest diff --git a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml index 8b32c0275e..8261a74353 100644 --- a/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml +++ b/detections/network/cisco_secure_firewall___remote_access_software_usage_traffic.yml @@ -1,12 +1,12 @@ name: Cisco Secure Firewall - Remote Access Software Usage Traffic id: ac54d39e-a75d-4f42-971d-006db3a0423a -version: 10 +version: 11 creation_date: '2025-05-28' -modification_date: '2026-09-22' -author: Nasreddine Bencherchali, Splunk +modification_date: '2026-10-08' +author: Nasreddine Bencherchali, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: | +description: |- The following analytic detects network traffic associated with known remote access software applications that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Cisco Secure Firewall Threat Defense Connection Event. @@ -17,6 +17,12 @@ data_source: - Cisco Secure Firewall Threat Defense Connection Event search: | `cisco_secure_firewall` EventType=ConnectionEvent + [ + | inputlookup remote_access_software + | search match_pattern!="" + | rename match_pattern as ClientApplication + | table ClientApplication + ] | stats min(_time) as firstTime max(_time) as lastTime values(dest_port) as dest_port values(dest) as dest @@ -24,13 +30,14 @@ search: | values(url) as url values(rule) as rule count by src ClientApplication action + + | lookup local=t remote_access_software match_pattern AS ClientApplication OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools appName AS ClientApplication OUTPUT category, appDescription as Description - | search category IN ("remote administration", "remote desktop control") | `remote_access_software_usage_exceptions` | `cisco_secure_firewall___remote_access_software_usage_traffic_filter` -how_to_implement: | +how_to_implement: |- This search requires Cisco Secure Firewall Threat Defense Logs, which includes the ConnectionEvent EventType. This search uses an input macro named `cisco_secure_firewall`. We strongly recommend that you specify your environment-specific configurations @@ -41,8 +48,9 @@ how_to_implement: | The access policy must also enable logging. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: | - It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Known false positives can be added to the + remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -61,7 +69,7 @@ intermediate_findings: - field: src type: system score: 20 - message: Traffic to known remote access software [$ClientApplication$] was detected from $src$. + message: Traffic associated with known remote access software [$ClientApplication$] was detected from [$src$]. threat_objects: - field: ClientApplication type: signature diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml index dc927f67a6..e201602591 100644 --- a/detections/network/detect_remote_access_software_usage_dns.yml +++ b/detections/network/detect_remote_access_software_usage_dns.yml @@ -1,35 +1,54 @@ name: Detect Remote Access Software Usage DNS id: a16b797d-e309-41bd-8ba0-5067dae2e4be -version: 15 +version: 16 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated promptly. +description: |- + The following analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, + and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. + Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, + ransomware attacks, and other severe impacts if these threats are not mitigated promptly. data_source: - Sysmon EventID 22 search: | | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Network_Resolution where - DNS.query=* - NOT DNS.query IN ("-", "unknown") - by DNS.answer DNS.answer_count DNS.query + + FROM datamodel=Network_Resolution + WHERE + [ + | inputlookup remote_access_software + | search domain!="" + | rename domain as DNS.query + | table DNS.query + ] + + BY DNS.answer DNS.answer_count DNS.query DNS.query_count DNS.reply_code_id DNS.src DNS.vendor_product | `drop_dm_object_name("DNS")` + + | lookup local=t remote_access_software domain AS query OUTPUT app as signature, category, reference, description + | eval dest = query + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t remote_access_software remote_domain AS query OUTPUT isutility, description as signature, - comment_reference as desc, category - | eval dest = query - | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_dns_filter` -how_to_implement: To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + To implement this search, you must ingest logs that contain the DNS query and the source of the query. These logs must be processed using + the appropriate Splunk Technology Add-ons that are specific to the DNS logs. The logs must also be mapped to the `Network_Resolution` data + model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" + macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you + track and maintain device-based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with + any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv + lookup to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -52,7 +71,7 @@ intermediate_findings: - field: src type: system score: 20 - message: A domain for a known remote access software $query$ was contacted by $src$. + message: A domain [$query$] for a known remote access software [$signature$] was contacted by [$src$]. threat_objects: - field: query type: domain diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml index f088392075..e38fdb539d 100644 --- a/detections/network/detect_remote_access_software_usage_traffic.yml +++ b/detections/network/detect_remote_access_software_usage_traffic.yml @@ -1,12 +1,12 @@ name: Detect Remote Access Software Usage Traffic id: 885ea672-07ee-475a-879e-60d28aa5dd42 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly -description: | +description: |- The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security. @@ -18,24 +18,39 @@ search: | max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(All_Traffic.user) as user - from datamodel=Network_Traffic where - All_Traffic.app=* - NOT All_Traffic.app IN ("-", "unknown") - by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in + + FROM datamodel=Network_Traffic + WHERE + [ + | inputlookup remote_access_software + | search match_pattern!="" + | rename match_pattern as All_Traffic.app + | table All_Traffic.app + ] + + BY All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product | `drop_dm_object_name("All_Traffic")` + + | lookup local=t remote_access_software match_pattern AS app OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | lookup local=t remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category - | search isutility = True | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_traffic_filter` -how_to_implement: The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. -known_false_positives: It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content +how_to_implement: |- + The following analytic was developed with Palo Alto traffic logs. Ensure that the logs are being ingested into Splunk and mapped to the Network_Traffic + data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro + leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain + device- based exceptions for this set of detections. +known_false_positives: |- + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -59,11 +74,11 @@ intermediate_findings: - field: src type: system score: 20 - message: Application traffic for a known remote access software [$signature$] was detected from $src$. + message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$]. - field: user type: user score: 20 - message: Application traffic for a known remote access software [$signature$] was detected from $src$. + message: Application traffic for a known remote access software [$signature$] was detected from [$src$] by [$user$]. threat_objects: - field: signature type: signature diff --git a/detections/network/http_post_request_with_encoded_payload.yml b/detections/network/http_post_request_with_encoded_payload.yml index f05fb1a082..b1bdfb2b63 100644 --- a/detections/network/http_post_request_with_encoded_payload.yml +++ b/detections/network/http_post_request_with_encoded_payload.yml @@ -2,14 +2,14 @@ name: HTTP POST Request with Encoded Payload id: 0590881d-7b81-48dd-9674-1f23f7db5d40 version: 1 creation_date: '2026-10-12' -modification_date: '2026-10-12' +modification_date: '2026-10-13' author: Raven Tait, Splunk status: production type: Anomaly description: |- - The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. - It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups. - This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. + The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex, base64, URL, XML, Unicode, or Octal encoded strings. + It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex, URL, XML, Unicode, or Octal escape sequences or sixteen or more consecutive base64 character groups. + This activity is significant as adversaries commonly use various encoding schemes to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads. data_source: - Zeek HTTP search: |- @@ -17,23 +17,35 @@ search: |- method="POST" post_body="*" - | eval dest_port=coalesce(dest_port, 'id.resp_p'), - dest=coalesce(dest, dest_ip, 'id.resp_h'), - src=coalesce(src, src_ip, 'id.orig_h') + NOT orig_mime_type_first_stated IN ( + "application/x-www-form-urlencoded", + "application/ocsp-request" + ) - | eval _hex=if(match(post_body, "(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), 1, 0) - | eval _b64=if(match(post_body, "(?:[A-Za-z0-9+/]{4}){16,}={0,2}"), 1, 0) + NOT user_agent IN ( + "MicroMessenger Client", + "Dalvik*", + "AliPayWallet*" + ) - | where _hex=1 OR _b64=1 + | eval dest_port=coalesce(dest_port, 'id.resp_p'), + dest=coalesce(dest, dest_ip, 'id.resp_h'), + src=coalesce(src, src_ip, 'id.orig_h') - | eval encoding_type=case(_hex=1 AND _b64=1, "Hexadecimal + Base64", _hex=1, "Hexadecimal", _b64=1, "Base64") + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\x[0-9a-fA-F]{2}){8,}|(?:%[0-9a-fA-F]{2}){8,}"), "Hexadecimal", ""), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:[A-Za-z0-9+\\/]{4}){16,}={0,2}"), encoding." + Base64", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:0x[A-Fa-f0-9]{2}){8,}"), encoding." + URL Encoding", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\&\\#x?[A-Za-z0-9]{2,3}\;?){8,}"), encoding." + XML Encoding", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\u[A-Fa-f0-9]{4}|\\\\u\{[A-Fa-f0-9]+\}){8,}"), encoding." + Unicode", encoding), " + ") + | eval encoding=ltrim(if(match(post_body, "^(?:\\\\\\d{3}){8,}"), encoding." + Octal", encoding), " + ") + | where encoding!="" | stats count min(_time) as firstTime - max(_time) as lastTime - values(encoding_type) as encoding_type - values(post_body) as post_body - - by src dest dest_port uri method status_code + max(_time) as lastTime + values(uri) as uri + values(encoding) as encoding + values(post_body) as post_body + by src dest dest_port method status_code | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -49,6 +61,7 @@ references: - https://attack.mitre.org/techniques/T1071/001/ - https://attack.mitre.org/techniques/T1132/001/ - https://docs.zeek.org/en/master/logs/http.html + - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/XSS%20Injection/README.md drilldown_searches: - name: View the detection results for - "$src$" search: '%original_detection_search% | search src = "$src$"' @@ -63,7 +76,7 @@ intermediate_findings: - field: src type: system score: 20 - message: An HTTP POST request with an encoded body of type [$encoding_type$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. + message: An HTTP POST request with an encoded body of type [$encoding$] was detected from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. threat_objects: - field: uri type: uri diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index 228dd2e6a2..e2a642be52 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,15 +1,18 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 17 +version: 18 creation_date: '2024-03-06' -modification_date: '2026-09-22' -author: Steven Dick +modification_date: '2026-10-08' +author: Steven Dick, Onur Mustafa Erdogan, Splunk status: production type: Anomaly description: | The following analytic detects the execution of known remote access software within the environment. - It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. - This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk. + It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote + access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. + This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed + malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, + posing a severe security risk. data_source: - Palo Alto Network Threat search: | @@ -22,28 +25,40 @@ search: | latest(Web.user) as user latest(Web.dest) as dest - from datamodel=Web where + FROM datamodel=Web + WHERE + Web.url_domain=* + NOT Web.url_domain IN ( + "-", + "unknown" + ) + [ + | inputlookup remote_access_software + | search domain!="" + | rename domain as Web.url_domain + | table Web.url_domain + ] - Web.url_domain=* - NOT Web.url_domain IN ( - "-", - "unknown" - ) - by Web.action Web.src Web.category + BY Web.action Web.src Web.category Web.url_domain Web.url_length + | `drop_dm_object_name("Web")` + | lookup local=t remote_access_software domain AS url_domain OUTPUT app as signature, category, reference, description + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `drop_dm_object_name("Web")` - | lookup local=t remote_access_software remote_domain AS url_domain OUTPUT isutility, description as signature, comment_reference - as desc, category - | search isutility = True + | `remote_access_software_usage_exceptions` | `detect_remote_access_software_usage_url_filter` how_to_implement: | - The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device- based exceptions for this set of detections. + The detection is based on data that originates from network logs. These logs must be processed using the appropriate Splunk Technology Add-ons + that are specific to the network logs. The logs must also be mapped to the `Web` data model. Use the Splunk Common Information Model (CIM) to + normalize the field names and speed up the data modeling process. The "exceptions" macro leverages both an Assets and Identities lookup, as well + as a KVStore collection called "remote_software_exceptions" that lets you track and maintain device-based exceptions for this set of detections. known_false_positives: | - It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup to globally suppress these situations across all remote access content + It is possible that legitimate remote access software is used within the environment. Ensure that the lookup is reviewed and updated with any additional + remote access software that is used within the environment. Known false positives can be added to the remote_access_software_usage_exception.csv lookup + to globally suppress these situations across all remote access content references: - https://attack.mitre.org/techniques/T1219/ - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ @@ -66,11 +81,11 @@ intermediate_findings: - field: src type: system score: 20 - message: A domain for a known remote access software $url_domain$ was contacted by $src$. + message: A domain for a known remote access software [$url_domain$] was contacted by [$src$]. - field: user type: user score: 20 - message: A domain for a known remote access software $url_domain$ was contacted by $src$. + message: A domain for a known remote access software [$url_domain$] was contacted by [$src$]. threat_objects: - field: signature type: signature diff --git a/lookups/csv/filesharing_domains_lookup.csv b/lookups/csv/filesharing_domains_lookup.csv new file mode 100644 index 0000000000..cda6d83921 --- /dev/null +++ b/lookups/csv/filesharing_domains_lookup.csv @@ -0,0 +1,103 @@ +domain,description +*0bin.net*,0bin.net +*1ty.me*,1ty.me +*235523.xyz*,235523.xyz +*8n1.org*,8n1.org +*99paste.com*,99paste.com +*anonfiles.com*,anonfiles.com +*apaste.info*,apaste.info +*beanpaste.fun*,beanpaste.fun +*bin.bloerg.net*,bin.bloerg.net +*bin.jarkon.fi*,bin.jarkon.fi +*bin.lysator.liu.se*,bin.lysator.liu.se +*bpa.st*,bpa.st +*cl1p.net*,cl1p.net +*clbin.com*,clbin.com +*codebeautify.org*,codebeautify.org +*codeshare.io*,codeshare.io +*commie.io*,commie.io +*controlc.com*,controlc.com +*crypticbin.com*,crypticbin.com +*cutapaste.net*,cutapaste.net +*defuse.ca*,defuse.ca +*dotnetfiddle.net*,dotnetfiddle.net +*dpaste.com*,dpaste.com +*everfall.com*,everfall.com +*filebin.net*,filebin.net +*fragbin.com*,fragbin.com +*friendpaste.com*,friendpaste.com +*ghostbin.co*,ghostbin.co +*gistpad.com*,gistpad.com +*glitch.me*,glitch.me +*gofile.io*,gofile.io +*hastebin.com*,hastebin.com +*hastebin.dev*,hastebin.dev +*ideone.com*,ideone.com +*ivpaste.com*,ivpaste.com +*jaw.gg*,jaw.gg +*jpst.it*,jpst.it +*jsbin.com*,jsbin.com +*jsfiddle.net*,jsfiddle.net +*jsitor.com*,jsitor.com +*justpaste.it*,justpaste.it +*justpaste.me*,justpaste.me +*kpaste.net*,kpaste.net +*lesma.eu*,lesma.eu +*mediafire.com*,mediafire.com +*mega.nz*,mega.nz +*modernpaste.com*,modernpaste.com +*n0paste.tk*,n0paste.tk +*nekobin.com*,nekobin.com +*nopaste.net*,nopaste.net +*notes.io*,notes.io +*p.ip.fi*,p.ip.fi +*paste-bin.xyz*,paste-bin.xyz +*paste.ax*,paste.ax +*paste.centos.org*,paste.centos.org +*paste.debian.net*,paste.debian.net +*paste.ee*,paste.ee +*paste.jp*,paste.jp +*paste.js.org*,paste.js.org +*paste.monster*,paste.monster +*paste.myst.rs*,paste.myst.rs +*paste.ofcode.org*,paste.ofcode.org +*paste.opensuse.org*,paste.opensuse.org +*paste.org.ru*,paste.org.ru +*paste.rohitab.com*,paste.rohitab.com +*paste.sh*,paste.sh +*paste.strictfp.com*,paste.strictfp.com +*paste2.org*,paste2.org +*pastebin*,pastebin +*pastecn.com*,pastecn.com +*pastecode.io*,pastecode.io +*pastecode.ru*,pastecode.ru +*pasted.co*,pasted.co +*pastee.dev*,pastee.dev +*pastejustit.com*,pastejustit.com +*pastelink.net*,pastelink.net +*pastes.io*,pastes.io +*pastesio.com*,pastesio.com +*pastetext.net*,pastetext.net +*pastey.gg*,pastey.gg +*pastie.org*,pastie.org +*primenotepad.com*,primenotepad.com +*privatebin.net*,privatebin.net +*privatlab*,privatlab +*privnote.com*,privnote.com +*quickhighlighter.com*,quickhighlighter.com +*rentry.co*,rentry.co +*send.exploit.in*,send.exploit.in +*sendspace.com*,sendspace.com +*snippet.host*,snippet.host +*storjshare.io*,storjshare.io +*temp.sh*,temp.sh +*termbin.com*,termbin.com +*textbin.net*,textbin.net +*tny.cz*,tny.cz +*transfer.sh*,transfer.sh +*tutpaste.com*,tutpaste.com +*ufile.io,ufile.io +*vpaste.net*,vpaste.net +*xi.pe*,xi.pe +*zerobin.net*,zerobin.net +*zigbin.io*,zigbin.io \ No newline at end of file diff --git a/lookups/csv/filesharing_domains_lookup.yml b/lookups/csv/filesharing_domains_lookup.yml new file mode 100644 index 0000000000..d907522ccf --- /dev/null +++ b/lookups/csv/filesharing_domains_lookup.yml @@ -0,0 +1,11 @@ +name: filesharing_domains_lookup +id: 325e53a9-50be-4b00-be34-7925063b4278 +version: 1 +creation_date: '2019-10-06' +modification_date: '2026-10-06' +author: Splunk Threat Research Team +lookup_type: csv +description: A list of file sharing domains and pastebin-style hosting domains that can be modified +match_type: + - WILDCARD(domain) +case_sensitive_match: false diff --git a/lookups/csv/remote_access_software.csv b/lookups/csv/remote_access_software.csv index f8b8619427..8896e65131 100644 --- a/lookups/csv/remote_access_software.csv +++ b/lookups/csv/remote_access_software.csv @@ -1,606 +1,2510 @@ -description,remote_domain,remote_utility,remote_utility_fileinfo,remote_appid,isutility,category,comment_reference,last_update -Absolute (Computrace),*search.namequery.com,rpcnet.exe,Absolute Software*,absolute-manage,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),*server.absolute.com,ctes.exe,Absolute Persistence*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,ctespersitence.exe,CTES*,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,cteshostsvc.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Absolute (Computrace),,rpcld.exe,,,TRUE,RMM,https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com,6/18/2024 -Ivanti Remote Control,*.ivanticloud.com,IvantiRemoteControl.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Ivanti Remote Control,,ArcUI.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Ivanti Remote Control,,AgentlessRC.exe,,,TRUE,RMM,https://rc1.ivanticloud.com/,2/9/2024 -Jump Desktop,*.jumpdesktop.com,jumpclient.exe,,jumpdesktop,TRUE,RMM,https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect,2/9/2024 -Microsoft Quick Assist,remoteassistance.support.services.microsoft.com*,quickassist.exe,Quick Assist,ms-quick-assist,TRUE,Built-in,https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca,2/9/2024 -MioNet (WD Anywhere Access),,mionet.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024 -MioNet (WD Anywhere Access),,mionetmanager.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016,2/9/2024 -mRemoteNG,user_managed,mRemoteNG.exe,,,TRUE,RMM,https://github.com/mRemoteNG/mRemoteNG,2/9/2024 -MSP360,*.cloudberrylab.com,Online Backup.exe,MSP360*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,*.msp360.com,CBBackupPlan.exe,Cloud.Ra*,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,*.mspbackups.com,Cloud.Backup.Scheduler.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Cloud.Backup.RM.Service.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,cbb.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaService.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaSd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaCmd.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,CloudRaUtilities.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Remote Desktop.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MSP360,,Connect.exe,,,TRUE,RMM,https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#,2/9/2024 -MyIVO,,myivomgr.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024 -MyIVO,,myivomanager.exe,,,TRUE,RMM,myivo.com - DOA as of 2024,2/9/2024 -N-Able Advanced Monitoring Agent,*remote.management,Agent_*_RW.exe,N-Able*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.logicnow.com,BASEClient.exe,Remote Monitoring*,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.us,BASupApp.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.eu.com,BASupSrvc.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*system-monitor.com,BASupSrvcCnfg.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,systemmonitor.us.cdn.cloudflare.net,BASupTSHelper.exe,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*cloudbackup.management,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*systemmonitor.co.uk,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.n-able.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.beanywhere.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -N-Able Advanced Monitoring Agent,*.swi-tc.com,,,,TRUE,RMM,https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm,2/9/2024 -NateOn-desktop sharing,*.nate.com,nateon*.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -NateOn-desktop sharing,,nateon.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -NateOn-desktop sharing,,nateonmain.exe,,,TRUE,RMM,http://rsupport.nate.com/rview/r8/main/index.aspx,2/9/2024 -Naverisk,user_managed,AgentSetup-*.exe,naverisk*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024 -Naverisk,,,NavMK1 Limited*,,TRUE,RMM,http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents,2/9/2024 -Netop Remote Control (Impero Connect),*.connect.backdrop.cloud,nhostsvc.exe,Impero Solutions*,netop-remote-control,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),*.netop.com,nhstw32.exe,Impero Connect*,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,ngstw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,Netop Ondemand.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,nldrw32.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,rmserverconsolemediator.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,ImperoInit.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netop Remote Control (Impero Connect),,Connect.Backdrop.cloud*.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/9/2024 -Netreo,charon.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -Netreo,activation.netreo.net,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -Netreo,*.api.netreo.com,,,,TRUE,RMM,https://solutions.netreo.com/docs/firewall-requirements,2/9/2024 -NetSupport Manager,*.netsupportmanager.com,pcictlui.exe,netsupport,netsupport-manager,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -NetSupport Manager,,pcicfgui.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -NetSupport Manager,,client32.exe,,,TRUE,RMM,https://www.netsupportmanager.com/resources/,2/9/2024 -Neturo,neturo.uplus.co.kr,neturo*.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024 -Neturo,,ntrntservice.exe,,,TRUE,RMM,"Obscure, located an older copy here: http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2",2/9/2024 -Netviewer (GoToMeet),,nvClient.exe,Algorius*,netviewer,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024 -Netviewer (GoToMeet),,netviewer.exe,,,TRUE,RMM,Obsolute - found copy here: https://www.enviolet.com/en/service/online-consultant.html,2/9/2024 -ngrok,user_managed,ngrok.exe,,,TRUE,Developer Utility,https://ngrok.com/docs/guides/running-behind-firewalls/,2/9/2024 -NinjaRMM,*.ninjaone.com,ninjarmmagent.exe,NinjaRMM*,,TRUE,RMM,https://www.ninjaone.com/faq/,2/9/2024 -NinjaRMM,*.ninjarmm.com,NinjaRMMAgentPatcher.exe,Ninja MSP*,,TRUE,RMM,https://www.ninjaone.com/faq/,4/4/2025 -NoMachine,user_managed,nomachine*.exe,NoMachine*,nomachine,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024 -NoMachine,,nxservice*.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,4/4/2025 -NoMachine,,nxd.exe,,,TRUE,RMM,https://kb.nomachine.com/AR04S01122,2/9/2024 -OCS inventory,user_managed,ocsinventory.exe,Ocs Inventory*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024 -OCS inventory,,ocsservice.exe,OcsPackager*,,TRUE,RMM,https://ocsinventory-ng.org/?page_id=878&lang=en,2/9/2024 -Panorama9,trusted.panorama9.com,p9agent*.exe,Panorama9*,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024 -Panorama9,changes.panorama9.com,,,,TRUE,RMM,https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with,2/9/2024 -Parallels Access,*.parallels.com,prl_deskctl_agent.exe,Parallels Access*,parallels-access,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,prl_deskctl_wizard.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,prl_pm_service.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -Parallels Access,,parallelsaccess-*.exe,,,TRUE,RMM,https://kb.parallels.com/en/129097,2/9/2024 -pcAnywhere,user_managed,awhost32.exe,,pcanywhere,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -pcAnywhere,,pcaquickconnect.exe,,pcanywhere-remote-control,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -pcAnywhere,,winaw32.exe,,pcanywhere-base,TRUE,RMM,https://en.wikipedia.org/wiki/PcAnywhere,2/9/2024 -Pcnow,,mwcliun.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcnow,,pcnmgr.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcnow,,webexpcnow.exe,,,TRUE,RMM,http://pcnow.webex.com/ - DOA as of 2024,2/9/2024 -Pcvisit,*.pcvisit.de,pcvisit.exe,pcvisit*,pcvisit,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit-easysupport.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pcvisit,,pcvisit_service_client.exe,,,TRUE,RMM,https://www.pcvisit.de/,2/9/2024 -Pilixo,*.pilixo.com,Pilixo_Installer*.exe,Pilixo*,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls,2/9/2024 -Pilixo,pilixo.com,rdp.exe,,,TRUE,RMM,https://pilixo.freshdesk.com/support/solutions/articles/9000141862-pilixo-anti-virus-and-anti-malware-exclusion-recommendations,2/9/2024 -Pilixo,download.pilixo.com,,,,TRUE,RMM,pilixo domain DOA as of 2024,2/9/2024 -Pocket Cloud (Wyse),,pocketcloud*.exe,PocketCloud*,pocket-cloud,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024 -Pocket Cloud (Wyse),,pocketcloudservice.exe,,,TRUE,RMM,https://wyse-pocketcloud.informer.com/2.1/,2/9/2024 -Pocket Controller (Soti Xsight),*soti.net,pocketcontroller.exe,Pocket Controller*,pocket-controller,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -Pocket Controller (Soti Xsight),,wysebrowser.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -Pocket Controller (Soti Xsight),,XSightService.exe,,,TRUE,RMM,https://pulse.soti.net/support/soti-xsight/help/,2/9/2024 -PSEXEC,user_managed,psexec.exe,Sysinternals PsExec,psexec,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024 -PSEXEC,,psexecsvc.exe,PsExec*,,TRUE,Remote Access,https://learn.microsoft.com/en-us/sysinternals/downloads/psexec,2/9/2024 -PSEXEC (Clone),user_managed,paexec.exe,Power Admin*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024 -PSEXEC (Clone),,PAExec-*.exe,PAExec*,,TRUE,Remote Access,https://www.poweradmin.com/paexec/,2/9/2024 -PSEXEC (Clone),,csexec.exe,,,TRUE,Remote Access,https://github.com/malcomvetter/CSExec,2/9/2024 -PSEXEC (Clone),,remcom.exe,Remote System Deployment*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024 -PSEXEC (Clone),,remcomsvc.exe,Remote Command Executor*,,TRUE,Remote Access,https://support.alertlogic.com/hc/en-us/articles/360034494351-Windows-Server-RemCom-Tool-Remote-Shell,2/9/2024 -PSEXEC (Clone),,xcmd.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024 -PSEXEC (Clone),,xcmdsvc.exe,,,TRUE,Remote Access,https://docs.bmc.com/docs/display/public/baob201204/xCmd+utility,2/9/2024 -PulseWay,user_managed,pcmonitorsrv.exe,Pulseway*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024 -Pulseway,,PCMonitorManager.exe,MMSoft Design*,,TRUE,RMM,https://intercom.help/pulseway/en/,2/9/2024 -QQ IM-remote assistance,*.mdt.qq.com,qq.exe,Tencent*,qq,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -QQ IM-remote assistance,*.desktop.qq.com,QQProtect.exe,QQ*,qq-rdp,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -QQ IM-remote assistance,upload_data.qq.com,qqpcmgr.exe,,,TRUE,RMM,https://en.wikipedia.org/wiki/Tencent_QQ,2/9/2024 -Quest KACE Agent (formerly Dell KACE),*.kace.com,konea.exe,KACE Agent*,,TRUE,RMM,https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function,2/9/2024 -RAdmin,user_managed,radmin.exe,famatech*,radmin,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -RAdmin,,famitrfc.exe,radmin*,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -RAdmin,,radmin3.exe,,,TRUE,RMM,https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,2/9/2024 -rdp2tcp,user_managed,tdp2tcp.exe,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024 -rdp2tcp,,rdp2tcp.py,,,TRUE,RMM,github.com/V-E-O/rdp2tcp,2/9/2024 -RDPView,user_managed,dwrcs.exe,,,TRUE,RMM,systemmanager.ru/dntu.en/rdp_view.htm - Same as Damware,2/9/2024 -rdpwrap,user_managed,RDPWInst.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -rdpwrap,,RDPCheck.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -rdpwrap,,RDPConf.exe,,,TRUE,Utility,github.com/stascorp/rdpwrap,2/9/2024 -Remobo,user_managed,remobo.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remobo,,remobo_client.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remobo,,remobo_tracker.exe,,,TRUE,RMM,https://www.remobo.com - DOA as of 2024,2/9/2024 -Remote Desktop Plus,,rdp.exe,Remote Desktop Plus*,,TRUE,Utility,https://www.donkz.nl/,2/9/2024 -Remote Manipulator System,*.internetid.ru,rfusclient.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024 -Remote Manipulator System,,rutserv.exe,,,TRUE,RMM,https://rmansys.ru/files/,2/9/2024 -Remote Utilities,*.internetid.ru,rutview.exe,Remote Utilities*,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024 -Remote Utilities,,rutserv.exe,,,TRUE,RMM,https://www.remoteutilities.com/download/,2/9/2024 -Remote.it,auth.api.remote.it,remote-it-installer.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -Remote.it,api.remote.it,remote.it.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -Remote.it,,remoteit.exe,,,TRUE,RMM,https://docs.remote.it/introduction/get-started,2/9/2024 -RemoteCall,*.remotecall.com,rcengmgru.exe,RSUPPORT*,remotecall,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,*.startsupport.com,rcmgrsvc.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,rxstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,rcstartsupport.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,raautoup.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,agentu.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemoteCall,,remotesupportplayeru.exe,,,TRUE,RMM,https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall,2/9/2024 -RemotePass Access,,remotepass-access.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePass Access,,rpaccess.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePass Access,,rpwhostscr.exe,,,TRUE,RMM,https://www.remotepass.com/rpaccess.html - DOA as of 2024,2/9/2024 -RemotePC,*.remotepc.com,remotepcservice.exe,remotedesktop*,remotepc,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,remotepc.com,rpcsuite.exe,remotepc*,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,*.remotedesktop.com,Idrive.File-Transfer,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,,idrive.RemotePCAgent,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemotePC,,remotepchost.exe,,,TRUE,RMM,https://www.remotedesktop.com/helpdesk/faq-firewall,2/9/2024 -RemoteView,*content.rview.com,remoteview.exe,RemoteView*,remoteview,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,*.rview.com,rv.exe,RsDoctor*,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,,rvagent.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RemoteView,,rvagtray.exe,,,TRUE,RMM,https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall,2/9/2024 -RES Automation Manager,user_managed,wisshell*.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmc_deployer.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -RES Automation Manager,,wmcsvc.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1,2/9/2024 -Royal Apps,user_managed,royalserver.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024 -Royal Apps,,royalts.exe,,,TRUE,RMM,https://www.royalapps.com/ts/win/download,2/9/2024 -RPort,user_managed,rport.exe,,,TRUE,RMM,https://kb.rport.io/using-the-remote-access,2/9/2024 -RuDesktop,*.rudesktop.ru,rd.exe,,rudesktop-remote-desktop,TRUE,RMM,https://rudesktop.ru,2/9/2024 -RuDesktop,,rudesktop*.exe,,,TRUE,RMM,https://asec.ahnlab.com/en/40263/,2/9/2024 -RustDesk,user_managed,rustdesk.exe,rustdesk*,rustdesk-remote-desktop,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024 -RustDesk,,rustdesk*.exe,,,TRUE,RMM,https://rustdesk.com/docs/en/,2/9/2024 -Senso.cloud,*.senso.cloud,SensoClient.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -Senso.cloud,,SensoService.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -Senso.cloud,,aadg.exe,,,TRUE,RMM,https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration,2/9/2024 -ServerEye,*.server-eye.de,servereye*.exe,ServerEye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ServerEye,,ServiceProxyLocalSys.exe,Server-Eye*,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ServerEye,,,,,TRUE,RMM,https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf,2/9/2024 -ShowMyPC,showmypc.com,showmypc*.exe,ShowMyPC*,showmypc,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -ShowMyPC,*.showmypc.com,showmypc.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -ShowMyPC,,SMPCSetup.exe,,,TRUE,RMM,https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf,2/9/2024 -SimpleHelp,user_managed,simplehelpcustomer.exe,SimpleHelp*,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,simpleservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,simplegatewayservice.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SimpleHelp,,remote access.exe,,,TRUE,RMM,https://simple-help.com/remote-support,2/9/2024 -SkyFex,skyfex.com,Deskroll.exe,DeskRoll Remote Desktop*,,TRUE,RMM,https://skyfex.com/,2/9/2024 -SkyFex,deskroll.com,DeskRollUA.exe,,,TRUE,RMM,https://skyfex.com/,2/9/2024 -SkyFex,*.deskroll.com,,,,TRUE,RMM,https://skyfex.com/,2/9/2024 -Sophos-Remote Management System,*.sophos.com,clientmrinit.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sophos-Remote Management System,*.sophosupd.com,mgntsvc.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sophos-Remote Management System,*.sophosupd.net,routernt.exe,,,TRUE,RMM,community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system,2/9/2024 -Sorillus,*.sorillus.com,Sorillus-Launcher*.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024 -Sorillus,sorillus.com,Sorillus Launcher.exe,,,TRUE,RMM,https://sorillus.com/,2/9/2024 -Splashtop Remote,splashtop.com,strwinclt.exe,Splashtop*,splashtop-remote,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.api.splashtop.com,Splashtop_Streamer_Windows*.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.relay.splashtop.com,SplashtopSOS.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,*.api.splashtop.eu,sragent.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srmanager.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srserver.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -Splashtop Remote,,srservice.exe,,,TRUE,RMM,https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services,2/9/2024 -SpyAnywhere,*.spytech-web.com,sysdiag.exe,,,TRUE,RMM,https://www.spyanywhere.com/support.shtml,2/9/2024 -247ithelp.com (ConnectWise),*.247ithelp.com,Remote Workforce Client.exe,,,TRUE,RMM,Simlar / replaced by ScreenConnect,2/8/2024 -Connectwise Automate (LabTech),*.hostedrmm.com,ltsvc.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Connectwise Automate (LabTech),,ltsvcmon.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Connectwise Automate (LabTech),,lttray.exe,,,TRUE,RMM,https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate,2/8/2024 -Distant Desktop,*.distantdesktop.com,distant-desktop.exe,Distant Software*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -Distant Desktop,*signalserver.xyz,dd.exe,Distant Desktop*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -Distant Desktop,,ddsystem.exe,German Gorodokuplya*,,TRUE,RMM,https://www.distantdesktop.com/manual/first-start.htm,2/8/2024 -GotoHTTP,gotohttp.com,gotohttp.exe,GotoHTTP*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024 -GotoHTTP,*.gotohttp.com,GotoHTTP_x64.exe,Pingbo*,,TRUE,RMM,https://gotohttp.com/goto/help.12x,2/8/2024 -GoToMyPC,*.GoToMyPC.com,g2file*.exe,GoTo Opener,gotomypc,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2quick.exe,GoToOpener,gotomypc-base,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2svc.exe,,gotomypc-desktop-sharing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2tray.exe,,gotomypc-remote-control,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2svc.exe,,gotomypc-printing,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2printh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2fileh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2tray.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,gopcsrv.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2host.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2comm.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -GoToMyPC,,g2mainh.exe,,,TRUE,RMM,https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,2/8/2024 -Goverlan,user_managed,goverrmc.exe,Goverlan*,goverlan,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,govsrv*.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovAgentInstallHelper.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovAgentx64.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Goverlan,,GovReachClient.exe,,,TRUE,RMM,https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf,2/8/2024 -Guacamole,user_managed,guacd.exe,,,TRUE,RMM,guacamole.apache.org,2/8/2024 -HelpBeam,,helpbeam*.exe,,,TRUE,RMM,https://www.helpbeam.com domain for sale in 2024,2/8/2024 -HelpU,helpu.co.kr,helpu_install.exe,helpU*,helpu,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -HelpU,*.helpu.co.kr,HelpuUpdater.exe,Help Manager Program,,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -HelpU,,HelpuManager.exe,,,TRUE,RMM,https://helpu.co.kr/,2/8/2024 -I'm InTouch,*.01com.com,iit.exe,I'm InTouch*,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -I'm InTouch,,intouch.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -I'm InTouch,,I'm InTouch Go Installer.exe,,,TRUE,RMM,https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/,2/8/2024 -Instant Housecall,*.instanthousecall.com,hsloader.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,*.instanthousecall.net,ihcserver.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -Instant Housecall,secure.instanthousecall.com,instanthousecall.exe,,,TRUE,RMM,https://instanthousecall.com/features/,2/8/2024 -IntelliAdmin Remote Control,user_managed,iadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,*.intelliadmin.com,intelliadmin.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent32.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent64.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -IntelliAdmin Remote Control,,agent_setup_5.exe,,,TRUE,RMM,intelliadmin.com/remote-control,2/8/2024 -Iperius Remote,*.iperiusremote.com,iperius.exe,Enter Srl*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -Iperius Remote,*.iperius.com,iperiusremote.exe,Enter S.R.L*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -Iperius Remote,*.iperius-rs.com,,Iperius Remote*,,TRUE,RMM,https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx,2/8/2024 -ISL Online,*.islonline.com,islalwaysonmonitor.exe,ISL Online*,isl-light,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,*.islonline.net,isllight.exe,ISL Light*,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,,isllightservice.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -ISL Online,,ISLLightClient.exe,,,TRUE,RMM,https://help.islonline.com/19818/165940,2/8/2024 -Itarian,*.itsm-us1.comodo.com,ITSMAgent.exe,Itarian*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,mdmsupport.comodo.com,ItsmRsp.exe,RMM*,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,*.cmdm.comodo.com,ITSMService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,remoteaccess.itarian.com,RDesktop.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,servicedesk.itarian.com,RHost.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RmmService.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,ComodoRemoteControl.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RAccess.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,RViewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -Itarian,,ITarianRemoteAccessSetup.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/8/2024 -ITSupport247 (ConnectWise),*.itsupport247.net,saazapsc.exe,,,TRUE,RMM,https://control.itsupport247.net/,2/8/2024 -Jump Desktop,jumpdesktop.com,jumpdesktop.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,jumpto.me,jumpservice.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,*.jumpto.me,jumpconnect.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Jump Desktop,,jumpupdater.exe,,,TRUE,RMM,https://jumpdesktop.com/connect/,2/8/2024 -Kabuto,*.kabuto.io,Kabuto.App.Runner.exe,,,TRUE,RMM,https://www.repairtechsolutions.com/documentation/kabuto/,2/8/2024 -Kaseya (VSA),deploy01.kaseya.com,agentmon.exe,Kaseya*,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -Kaseya (VSA),*managedsupport.kaseya.net,KaUpdHlp.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -Kaseya (VSA),*.kaseya.net,KaUsrTsk.exe,,,TRUE,RMM,https://helpdesk.kaseya.com/hc/en-gb/articles/229012608-Software-Deployment-URL-Port-Requirements,2/8/2024 -KickIdler,kickidler.com,grabberEM.*msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024 -KickIdler,my.kickidler.com,grabberTT*.msi,,,TRUE,RMM,https://www.kickidler.com/for-it/faq/,2/8/2024 -LANDesk,*.ivanticloud.com,issuser.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,*.ivanti.com,landeskagentbootstrap.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,LANDeskPortalManager.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,ldinv32.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -LANDesk,,ldsensors.exe,,,TRUE,RMM,https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US,2/8/2024 -Laplink Everywhere,everywhere.laplink.com,laplink.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,le.laplink.com,laplink-everywhere-setup*.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,atled.syspectr.com,laplinkeverywhere.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,llrcservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,serverproxyservice.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Everywhere,,OOSysAgent.exe,,,TRUE,RMM,https://everywhere.laplink.com/docs,2/8/2024 -Laplink Gold,user_managed,tsircusr.exe,,,TRUE,RMM,wen.laplink.com/product/laplink-gold,2/8/2024 -Level.io,level.io,level-windows-amd64.exe,Level*,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -Level.io,*.level.io,level.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -Level.io,,level-remote-control-ffmpeg.exe,,,TRUE,RMM,https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues,2/8/2024 -LiteManager,*.litemanager.ru,romfusclient.exe,Yakhnovets Denis*,litemanager,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,*.litemanager.com,romviewer.exe,ROMServer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,,romserver.exe,ROMViewer*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LiteManager,,lmnoipserver.exe,LiteManager*,,TRUE,RMM,https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/,2/8/2024 -LogMeIn,*logmein.eu,lmiguardiansvc.exe,LogMeIn*,logmein,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,*.logmeininc.com,lmiignition.exe,RemotelyAnywhere*,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,*.logmein.com,logmein.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,logmeinsystray.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,logmein*.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn,,lmiignition.exe,,,TRUE,RMM,https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration,2/8/2024 -LogMeIn rescue,*.logmeinrescue.com,support-logmeinrescue*.exe,,logmeinrescue,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -LogMeIn rescue,*.logmeinrescue.eu,support-logmeinrescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -LogMeIn rescue,,lmi_rescue.exe,,,TRUE,RMM,https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.com,dcagentservice.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.com.eu,dcagentregister.exe,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),desktopcentral.manageengine.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.dms.zoho.com,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.dms.zoho.com.eu,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -Manage Engine (Desktop Central),*.-dms.zoho.com.cn,,,,TRUE,RMM,https://www.manageengine.com/products/desktop-central/help/domains-required-for-agent-communication.html,2/8/2024 -MeshCentral,user_managed,meshcentral*.exe,meshcentral,,TRUE,RMM,https://ylianst.github.io/MeshCentral/meshcentral/,2/8/2024 -Microsoft RDP,,mstsc.exe,,ms-rdp,TRUE,Built-in,https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/windows,2/8/2024 -Microsoft TSC,,termsrv.exe,,,TRUE,Built-in,https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/terminal-server-startup-connection-application,2/8/2024 -Netop Remote Control (Impero Connect),,ImperoClientSVC.exe,,,TRUE,RMM,https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html,2/8/2024 -Access Remote PC,,rpcgrab.exe,,,TRUE,RMM,,2/7/2024 -Access Remote PC,,rpcsetup.exe,,,TRUE,RMM,,2/7/2024 -Action1,*.action1.com,action1_agent.exe,Action1*,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,action1.com,action1_remote.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,a1-backend-packages.s3.amazonaws.com,action1_connector.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -Action1,server.action1.com,action1_update.exe,,,TRUE,RMM,https://www.action1.com/documentation/firewall-configuration/,2/7/2024 -AeroAdmin,auth*.aeroadmin.com,aeroadmin.exe,AeroAdmin*,aeroadmin,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024 -AeroAdmin,aeroadmin.com,,Aero Admin*,,TRUE,RMM,https://support.aeroadmin.com/kb/faq.php?id=58,2/7/2024 -AliWangWang-remote-control,wangwang.taobao.com,alitask.exe,AliWangWang*,ali-wangwang,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024 -AliWangWang-remote-control,,,,ali-wangwang-remote-control,TRUE,RMM,https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale,2/7/2024 -Alpemix,*.alpemix.com,alpemix.exe,Alpemix*,alpemix,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024 -Alpemix,*.teknopars.com,,Teknopars*,,TRUE,RMM,https://www.alpemix.com/en/remote-access,2/7/2024 -Ammyy Admin,*ammyy.com,aa_v*.exe,Ammyy*,ammyy-admin,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024 -Ammyy Admin,,AMMYY_Admin.exe,,,TRUE,RMM,https://www.ammyy.com/en/admin_security.html,2/7/2024 -AnyDesk,*net.anydesk.com,anydesk.exe,anydesk*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024 -AnyDesk,,,philandro Software*,anydesk,TRUE,RMM,https://support.anydesk.com/knowledge/firewall,2/7/2024 -Anyplace Control,anyplace-control.com,apc_host.exe,Anyplace*,anyplace-remote-control,TRUE,RMM,http://www.anyplace-control.com/anyplace-control/help/faq.htm,2/7/2024 -AnyViewer,controlserver.anyviewer.com,AnyViewerSetup.exe,AOMEI*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -AnyViewer,*.aomeisoftware.com,RCClient.exe,Anyviewer*,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -AnyViewer,aomeisoftware.com,RCService.exe,,,TRUE,RMM,https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,2/7/2024 -Atera RMM,agent-api.atera.com,atera_agent.exe,Atera Networks,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Atera RMM,pubsub.atera.com,ateraagent.exe,AteraAgent,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Atera RMM,,syncrosetup.exe,,,TRUE,RMM,https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,2/7/2024 -Auvik,*.my.auvik.com,auvik.engine.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024 -Auvik,*.auvik.com,auvik.agent.exe,,,TRUE,RMM,https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use,2/7/2024 -AweRay,asapi*.aweray.net,aweray_remote*.exe,AweRay*,awesun,TRUE,RMM,https://sun.aweray.com/help,2/7/2024 -AweRay,client-api.aweray.com,AweSun.exe,AweSun*,,TRUE,RMM,https://sun.aweray.com/help,2/7/2024 -Barracuda,*.islonline.net,,Barracuda MSP,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Barracuda,rmm.barracudamsp.com,,Barracuda Networks,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Barracuda,,,LPI Level Platforms,,TRUE,RMM,https://help.islonline.com/19799/166125,2/7/2024 -Basecamp,,,,,TRUE,RMM,basecamp.com - No specific RMM tool listed,2/7/2024 -BeamYourScreen,beamyourscreen.com,beamyourscreen.exe,BeamYourScreen*,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024 -BeamYourScreen,*.beamyourscreen.com,beamyourscreen-host.exe,,,TRUE,RMM,beamyourscreen redirects to https://www.mikogo.com/,2/7/2024 -BeAnyWhere,beanywhere.com,BASupConHelper.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,*.beanywhere.com,BASupSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSrvcCnfg.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSrvcUpdater.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupSysInf.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupAppSrvc.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupAppElev.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,TakeControl.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeAnyWhere,,BASupApp.exe,,,TRUE,RMM,https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx,2/7/2024 -BeyondTrust (Bomgar),*.beyondtrustcloud.com,bomgar-scc-*.exe,BeyondTrust*,beyond-trust-remote-support,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),*.bomgarcloud.com,bomgar-scc.exe,Bomgar*,bomgar,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),bomgarcloud.com,bomgar-pac-*.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),,bomgar-pac.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -BeyondTrust (Bomgar),,bomgar-rdp.exe,,,TRUE,RMM,https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm,2/7/2024 -CentraStage (Now Datto),*.rmm.datto.com,CagService.exe,Datto*,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024 -CentraStage (Now Datto),*cc.centrastage.net,AEMAgent.exe,,,TRUE,RMM,https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm,2/7/2024 -Centurion,centuriontech.com,ctiserv.exe,,,TRUE,RMM,https://data443.atlassian.net/servicedesk/customer/portal/20,2/7/2024 -Chrome Remote Desktop,*remotedesktop.google.com,remote_host.exe,Chrome Remote Desktop,chrome-remote-desktop,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024 -Chrome Remote Desktop,*remotedesktop-pa.googleapis.com,remoting_host.exe,,,TRUE,RMM,https://support.google.com/chrome/a/answer/2799701?hl=en,2/7/2024 -CloudFlare Tunnel,,cloudflared.exe,,,TRUE,Remote Access,cloudflare.com/products/tunnel/,2/7/2024 -Comodo RMM,*.itsm-us1.comodo.com,itsmagent.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024 -Comodo RMM,*mdmsupport.comodo.com,rviewer.exe,,,TRUE,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html",2/7/2024 -CrossLoop,*.crossloop.com,crossloopservice.exe,Crossloop*,crossloop,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossLoop,,CrossLoopConnect.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossLoop,,WinVNCStub.exe,,,TRUE,RMM,www.CrossLoop.com -> redirects to avast.com,2/7/2024 -CrossTec Remote Control,user_managed,PCIVIDEO.EXE,CrossTec,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024 -CrossTec Remote Control,,supporttool.exe,,,TRUE,RMM,www.crosstecsoftware.com/supporthome.html - domain DOA 2/1/2024,2/7/2024 -CruzControl,,,,,TRUE,RMM,https://resources.doradosoftware.com/cruz-rmm,2/7/2024 -Dameware,user_managed,dntus*.exe,DameWare*,dameware-mini-remote,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,dwrcs.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,DameWare Remote Support.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,SolarWinds-Dameware-MRC*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,DameWare Mini Remote Control*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -Dameware,,SolarWinds-Dameware-DRS*.exe,,,TRUE,RMM,https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm,2/7/2024 -DeskDay,deskday.ai,ultimate_*.exe,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024 -DeskDay,app.deskday.ai,,,,TRUE,RMM,https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate,2/7/2024 -Domotz,*.domotz.co,domotz*.exe,Domotz*,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,*cell-1.domotz.com,domotz_bash.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,domotz.com,domotz-windows*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,Domotz Pro Desktop App.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,Domotz Pro Desktop App Setup*.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -Domotz,,domotz.exe,,,TRUE,RMM,https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/,2/7/2024 -DW Service,*.dwservice.net,dwagsvc.exe,DWSNET*,dws-remote-control,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -DW Service,,dwagent.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -DW Service,,dwagsvc.exe,,,TRUE,RMM,https://news.dwservice.net/dwservice-security-infrastructure/,2/7/2024 -Echoware,,echoserver*.exe,,echoware,TRUE,RMM,,2/7/2024 -Echoware,,echoware.dll,,,TRUE,RMM,,2/7/2024 -Electric AI (Kaseya),,,,,TRUE,RMM,https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf,2/7/2024 -EMCO Remote Console,user_managed,remoteconsole.exe,,,TRUE,RMM,,2/7/2024 -Encapto,,,,,TRUE,RMM,https://www.encapto.com - used to manage Cisco services,2/7/2024 -Ericom AccessNow,user_managed,accessserver*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -Ericom Connect,user_managed,EricomConnectRemoteHost*.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -Ericom Connect,,ericomconnnectconfigurationtool.exe,,,TRUE,RMM,https://www.ericom.com/connect-accessnow/,2/7/2024 -ESET Remote Administrator,user_managed,era.exe,ESET Management*,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,einstaller.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,ezhelp*.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,eratool.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ESET Remote Administrator,,ERAAgent.exe,,,TRUE,RMM,eset.com/me/business/remote-management/remote-administrator/,2/7/2024 -ezHelp,*.ezhelp.co.kr,ezhelpclientmanager.exe,Mastersoft Corp*,ezhelp,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -ezHelp,,ezHelpManager.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -ezHelp,,ezhelpclient.exe,,,TRUE,RMM,https://www.exhelp.co.kr,2/7/2024 -FastViewer,*.fastviewer.com,fastclient.exe,Fastviewer*,fastviewer,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FastViewer,,fastmaster.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FastViewer,,FastViewer.exe,,,TRUE,RMM,https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf,2/7/2024 -FixMe.it,*.fixme.it,FixMeit Unattended Access Setup.exe,FixMe*,techinline,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*.techinline.net,TiExpertStandalone.exe,SetMe*,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,fixme.it,FixMeitClient*.exe,FixMe.IT Helper,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*set.me,FixMeit Client.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,*setme.net,FixMeit Expert Setup.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiExpertCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,fixmeitclient.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiClientCore.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FixMe.it,,TiClientHelper*.exe,,,TRUE,RMM,https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use,2/7/2024 -FleetDesk.io,*.fleetdeck.io,fleetdeck_agent_svc.exe,FleetDeck*,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,cognito-idp.us-west-2.amazonaws.com,fleetdeck_commander_svc.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,fleetdeck.io,fleetdeck_installer.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,,fleetdeck_agent.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -FleetDesk.io,,fleetdeck_commander_launcher.exe,,,TRUE,RMM,https://fleetdeck.io/faq/,2/7/2024 -Fortra,,,,,TRUE,RMM,https://www.fortra.com - No free/cloud RMM softwars listed,2/7/2024 -GatherPlace-desktop sharing,*.gatherplace.com,gp3.exe,Gatherworks*,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GatherPlace-desktop sharing,*.gatherplace.net,gp4.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GatherPlace-desktop sharing,,gp5.exe,,,TRUE,RMM,https://www.gatherplace.com/kb?id=136377,2/7/2024 -GetScreen,*.getscreen.me,getscreen.exe,getscreen.me*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024 -GetScreen,getscreen.me,,Point B Ltd*,,TRUE,RMM,https://docs.getscreen.me/self-hosted/system-requirements/,2/7/2024 -GoToAssist,goto.com,gotoassist.exe,GoToAssist*,gotoassist,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.getgo.com,g2a*.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.fastsupport.com,GoTo Assist Opener.exe,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,helpme.net,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.me,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.gotoassist.at,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -GoToAssist,*.desktopstreaming.com,,,,TRUE,RMM,https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5,2/7/2024 -Mikogo,*.real-time-collaboration.com,mikogo.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,*.mikogo4.com,mikogo-starter.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,*.mikogo.com,mikogo-service.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Mikogo,,mikogolauncher.exe,,,TRUE,RMM,https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services,2/7/2024 -Pandora RC (eHorus),portal.ehorus.com,ehorus standalone.exe,eHorus*,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_agent.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_launcher.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -Pandora RC (eHorus),,ehorus_display.exe,,,TRUE,RMM,https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction,2/7/2024 -ScreenConnect (ConnectWise),*.connectwise.com,Remote Workforce Client.exe,ConnectWise*,screenconnect,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),*.screenconnect.com,screenconnect*.exe,ScreenConnect*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),,ConnectWiseControl*.exe,CONTINUUM MANAGED*,,TRUE,RMM,https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,2/7/2024 -ScreenConnect (ConnectWise),,connectwise*.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenConnect (ConnectWise),,screenconnect.windowsclient.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenConnect (ConnectWise),,screenconnect.clientservice.exe,,,TRUE,RMM,https://cybir.com/2022/cve/bypasssing-connectwise-and-endpoint-controls/,2/7/2024 -ScreenMeet,*.screenmeet.com,ScreenMeetSupport.exe,ScreenMeet*,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024 -ScreenMeet,*.scrn.mt,ScreenMeet.Support.exe,,,TRUE,RMM,https://docs.screenmeet.com/docs/firewall-white-list,2/7/2024 -Seetrol,seetrol.co.kr,seetrolcenter.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolclient.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolmyservice.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolremote.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -Seetrol,,seetrolsetting.exe,,,TRUE,RMM,http://www.seetrol.com/en/features/features3.php,2/7/2024 -SuperOps,superops.ai,superopsticket.exe,SuperOps*,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superops.ai,superops.exe,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,serv.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superopsalpha.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -SuperOps,*.superopsbeta.com,,,,TRUE,RMM,https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent,2/7/2024 -Visual Studio Dev Tunnel,global.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Visual Studio Dev Tunnel,*.rel.tunnels.api.visualstudio.com,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Visual Studio Dev Tunnel,*.devtunnels.ms,,,,TRUE,Developer Utility,https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security,2/7/2024 -Addigy,prod.addigy.com,addigy-*.pkg,Addigy*,,TRUE,RMM,https://addigy.com/,2/27/2024 -Addigy,grtmprod.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024 -Addigy,agents.addigy.com,,,,TRUE,RMM,https://addigy.com/,2/27/2024 -Adobe Connect,*.adobeconnect.com,ConnectAppSetup*.exe,Adobe Connect,adobe-connect,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,ConnectShellSetup*.exe,,adobe-meeting-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,Connect.exe,,adobe-connectnow,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Adobe Connect,,ConnectDetector.exe,,adobe-connectnow-remote-control,TRUE,RMM,https://helpx.adobe.com/adobe-connect/firewall-proxy-server-configuration-adobe-connect.html,2/27/2024 -Any Support,*.anysupport.net,ManualLauncher.exe,AnySupport*,anysupport,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024 -Any Support,,,"Koino Co., Ltd.",,TRUE,RMM,https://www.anysupport.net/introduce_howto.php,2/27/2024 -Acronic Cyber Protect (Remotix),cloud.acronis.com,AcronisCyberProtectConnectQuickAssist*.exe,Acronis Cyber Protect Connect Quick Assist,remotix,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),agents*-cloud.acronis.com,AcronisCyberProtectConnectAgent.exe,Acronis Cyber Protect Connect Agent,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),gw.remotix.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -Acronic Cyber Protect (Remotix),connect.acronis.com,,,,TRUE,RMM,https://kb.acronis.com/content/47189,2/26/2024 -BeInSync,*.beinsync.net,Beinsync*.exe,BeInSync,beinsync,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024 -BeInSync,*.beinsync.com,,BeInSync Client GUI,,TRUE,RMM,https://en.wikipedia.org/wiki/Phoenix_Technologies,2/26/2024 -DeskNets,,,,desknets,TRUE,RMM,https://www.desknets.com/en/download.html,2/26/2024 -DeskShare,user_managed,TeamTaskManager.exe,Team Task Manager*,deskshare,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024 -DeskShare,,DSGuest.exe,DeskShare*,,TRUE,RMM,https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx,2/26/2024 -DesktopNow,*.nchuser.com,desktopnow.exe,DesktopNow*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024 -DesktopNow,,,NCH Software*,,TRUE,RMM,https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US,2/26/2024 -Jump Cloud,*.api.jumpcloud.com,JumpCloud*.exe,JumpCloud*,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024 -Jump Cloud,*.assist.jumpcloud.com,,,,TRUE,RMM,https://jumpcloud.com/support/understand-remote-assist-agent,2/26/2024 -KHelpDesk,*.khelpdesk.com.br,KHelpDesk.exe,KHELPDESK*,khelpdesk-remote-control,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024 -KHelpDesk,,,Ferramenta de Acesso Remoto,,TRUE,RMM,https://www.khelpdesk.com.br/en-us,2/26/2024 -MyGreenPC,*mygreenpc.com,mygreenpc.exe,,mygreenpc,TRUE,RMM,http://www.mygreenpc.com/,2/26/2024 -NTR Remote,*.ntrsupport.com,NTRsupportPro_EN.exe,Net Transmit & Receive SL,ntr-remote,TRUE,RMM,DOA as of 2024,2/26/2024 -OptiTune,*.optitune.us,OTService.exe,Bravura Software*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024 -OptiTune,*.opti-tune.com,OTPowerShell.exe,OptiTune*,,TRUE,RMM,https://www.bravurasoftware.com/optitune/support/faq.aspx,2/26/2024 -PDQ Connect,app.pdq.com,pdq-connect*.exe,PDQ.com*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024 -PDQ Connect,cfcdn.pdq.com,,PDQConnectAgent*,,TRUE,RMM,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements,2/26/2024 -SunLogin,sunlogin.oray.com,OrayRemoteShell.exe,Shanghai Best Oray*,sunlogin-remote-control,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -SunLogin,client.oray.net,OrayRemoteService.exe,Remote control service,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -SunLogin,,sunlogin*.exe,,,TRUE,RMM,https://sunlogin.oray.com/en/embed/software.html,2/26/2024 -Synergy,user_managed,,,synergy,TRUE,RMM,https://symless.com/synergy,2/26/2024 -Syspectr,atled.syspectr.com,oo-syspectr*.exe,O&O Syspectr*,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024 -Syspectr,app.syspectr.com,OOSysAgent.exe,,,TRUE,RMM,https://www.syspectr.com/en/installation-in-a-network,2/26/2024 -TigerVNC,user_managed,tigervnc*.exe,TigerVNC*,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024 -TigerVNC,,winvnc4.exe,,,TRUE,RMM,https://github.com/TigerVNC/tigervnc/releases,2/26/2024 -Apple Remote Desktop,user_managed,ARDAgent.app,,apple-remote-desktop,TRUE,RMM,https://support.apple.com/guide/remote-desktop/install-and-set-up-remote-desktop-apdf49e03a4/mac,2/24/2024 -Rapid7,*.analytics.insight.rapid7.com,ir_agent.exe,Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Rapid7,*.endpoint.ingress.rapid7.com,rapid7_agent_core.exe,Rapid7 Insight Agent*,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Rapid7,,rapid7_endpoint_broker.exe,,,TRUE,RMM,https://docs.rapid7.com/insightvm/configure-communications-with-the-insight-platform/,2/14/2024 -Tactical RMM,login.tailscale.com,tacticalrmm.exe,AmidaWare*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024 -Tactical RMM,login.tailscale.com,tacticalrmm.exe,Tactical Techs*,,TRUE,RMM,docs.tacticalrmm.com,2/14/2024 -Tailscale,*.tailscale.com,tailscale-*.exe,Tailscale*,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tailscale,*.tailscale.io,tailscaled.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tailscale,,tailscale-ipn.exe,,,TRUE,Remote Access,https://tailscale.com/kb/1023/troubleshooting,2/14/2024 -Tanium,cloud.tanium.com,TaniumClient.exe,Tanium*,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,*.cloud.tanium.com,TaniumCX.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TaniumExecWrapper.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TaniumFileInfo.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -Tanium,,TPowerShell.exe,,,TRUE,RMM,https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html,2/14/2024 -TeamViewer,*.teamviewer.com,teamviewer*.exe,TeamViewer*,teamviewer,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,teamviewerqs.exe,,teamviewer-remote-control,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,tv_w32.exe,,teamviewer-sharing,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,tv_w64.exe,,teamviewer-base,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeamViewer,,teamviewer.exe,,teamviewer-web,TRUE,RMM,https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,2/14/2024 -TeleDesktop,user_managed,pstlaunch.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TeleDesktop,,ptdskclient.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TeleDesktop,,ptdskhost.exe,,,TRUE,RMM,http://potomacsoft.com/ - DOA as of 2024,2/14/2024 -TightVNC,user_managed,tvnviewer.exe,TightVNC*,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -TightVNC,,TightVNCViewerPortable*.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -TightVNC,,tvnserver.exe,,,TRUE,RMM,https://www.tightvnc.com/doc/win/TightVNC_for_Windows-Installation_and_Getting_Started.pdf,2/14/2024 -ToDesk,todesk.com,todesk.exe,ToDesk*,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -ToDesk,*.todesk.com,ToDesk_Service.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -ToDesk,*.todesk.com,ToDesk_Setup.exe,,,TRUE,RMM,https://www.todesk.com/,2/14/2024 -TurboMeeting,user_managed,pcstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -TurboMeeting,,turbomeeting.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -TurboMeeting,,turbomeetingstarter.exe,,,TRUE,RMM,http://sourcing.rhubcom.com/v5/faqs.html#collapsetwentysix2-topdiv,2/14/2024 -UltraViewer,* .ultraviewer.net,UltraViewer_Service.exe,UltraViewer*,ultraviewer,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,UltraViewer_setup*,DucFabulous*,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,UltraViewer_Desktop.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraViewer,,ultraviewer.exe,,,TRUE,RMM,https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html,2/14/2024 -UltraVNC,user_managed,UltraVNC*.exe,,,TRUE,Remote Access,https://uvnc.com/docs/uvnc-server/49-UltraVNC-server-configuration.html,2/14/2024 -VNC,user_managed,vncserver.exe,realvnc*,vnc,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winvnc*.exe,,vnc-clipboard,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,vncviewer.exe,,vnc-print,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,vncserverui.exe,,vnc-encrypted,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winwvc.exe,,vnc-filetransfer,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,winvncsc.exe,,vnc-base,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -VNC,,,,vnc-http,TRUE,Remote Access,https://realvnc.com/en/connect/download/vnc,2/14/2024 -WebEx (Remote Access),,,,,TRUE,Remote Access,https://help.webex.com/en-us/article/nyc3q0b/Set-Up-a-Computer-for-Remote-Access,2/14/2024 -WebRDP,user_managed,webrdp.exe,,,TRUE,RMM,github.com/Mikej81/WebRDP,2/14/2024 -Weezo,*.weezo.me,weezohttpd.exe,Peer 2 World,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Weezo,weezo.net,weezo.exe,Weezo*,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Weezo,*.weezo.net,weezo setup*.exe,,,TRUE,RMM,weezo.en.softonic.com,2/14/2024 -Xeox,xeox.com,xeox-agent_*.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024 -Xeox,*.xeox.com,xeox_service_windows.exe,,,TRUE,RMM,https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW,2/14/2024 -Zabbix Agent,user_managed,zabbix_agent*.exe,Zabbix*,,TRUE,RMM,https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent,2/14/2024 -ZeroTier,zerotier.com,zerotier*.msi,ZeroTier*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -ZeroTier,*.zerotier.com,zerotier*.exe,zero-powesrhell*,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -ZeroTier,,zero-powershell.exe,,,TRUE,RMM,https://my.zerotier.com/,2/14/2024 -Zoho Assist,*.zoho.com,za_connect.exe,Zoho*,zoho-assist,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.eu,zaservice.exe,,zoho-assist-base,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.in,zohotray.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.com.au,ZohoMeeting.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zoho.com.cn,Zohours.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.com,ZohoURSService.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.jp,ZMAgent.exe,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,*.zohoassist.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,downloads.zohodl.com.cn,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,downloads.zohocdn.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Zoho Assist,gateway.zohoassist.com,,,,TRUE,RMM,https://www.zoho.com/assist/kb/firewall-configuration.html,2/14/2024 -Site24x7,plus*.site24x7.com,MEAgentHelper.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.eu,MonitoringAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.in,Site24x7WindowsAgentTrayIcon.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.cn,Site24x7PluginAgent.exe,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Site24x7,plus*.site24x7.net.au,,,,TRUE,RMM,https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent,2/13/2024 -Supremo,supremocontrol.com,supremo.exe,SupRemo*,supremo,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,*.supremocontrol.com,supremohelper.exe,NanoSystems*,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,*.nanosystems.it,supremoservice.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremohelper.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremo.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Supremo,,supremosystem.exe,,,TRUE,RMM,https://www.supremocontrol.com/frequently-asked-questions/,2/13/2024 -Syncro,app.kabuto.io,Kabuto.App.Runner.exe,Servably*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.syncromsp.com,Kabuto.Service.Runner.exe,Syncro*,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.syncroapi.com,Kabuto.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,*.kabutoservices.com,KabutoSetup.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,ld.aurelius.host,Syncro.Overmind.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,attachments.servably.com,SyncroLive.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,SyncroLive.Agent.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.App.Runner.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.Installer.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Syncro,,Syncro.Service.exe,,,TRUE,RMM,https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004,2/13/2024 -Devolutions Remote Desktop Manager,*cloud.devolutions.net,RemoteDesktopManager*.exe,Devolutions inc,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Devolutions Remote Desktop Manager,*api.devolutions.com,Devolutions.Updater.exe,Remote Desktop Manager,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Devolutions Remote Desktop Manager,*telemetry2.devolutions.net,,,,TRUE,RMM,https://docs.devolutions.net/server/kb/knowledge-base/internet-endpoints-server/,2/10/2025 -Koofr,*app.koofr.net,storagegui.exe,koofr*,,TRUE,FileSync,https://app.koofr.net/dl/apps/win,2/10/2025 -Koofr,,storagechrome.exe,,,TRUE,FileSync,https://app.koofr.net/dl/apps/win,2/10/2025 -MEGA Sync,*mega.co.nz,MEGAsyncSetup*.exe,MEGA Limited,mega-base,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -MEGA Sync,*api.mega.co.nz,Megasync.exe,MEGAsync,mega-chat,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -MEGA Sync,*mega.nz,MegaUpdater.exe,,,TRUE,FileSync,https://help.mega.io/security/data-protection/official-domains,2/10/2025 -NordLocker,*cloud.nordlocker.com,nordlockersetup*.exe,nordvpn*,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -NordLocker,*.nordcdn.com,NordLocker.exe,NordLocker,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -NordLocker,*auth.nordlocker.com,NordUpdateService.exe,NordSec Update Service,,TRUE,FileSync,https://support.nordlocker.com/hc/en-us/articles/360015151597-Guide-for-NordLocker-Windows,2/10/2025 -Total Software Deployment,*.softinventive.com,tsd-setup.exe,SoftInventive Lab,,TRUE,RMM,https://docs.softinventive.com/tsd/faq/,2/10/2025 -Total Software Deployment,,tsd.exe,Total Software Deployment,,TRUE,RMM,https://docs.softinventive.com/tsd/faq/,2/10/2025 -Yandex Disk,*disk.yandex.run,YandexDisk*Setup.exe,Yandex LLC,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,*cloud-api.yandex.net,YandexDisk2.exe,Yandex.Disk,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,*yastatic.net,YandexNotes.exe,Yandex,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Yandex Disk,passport.yandex.com,,,,TRUE,FileSync,https://yandex.com/support/search-results/?service=yandex-360,2/10/2025 -Glance,screenshare-location.glance.net,GlanceSetup*.exe,GlanceClient*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,s*.glance.net,GlanceGuestSetup*.exe,GlanceLauncher*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,pr*.glance.net,Glance.exe,Glance Setup*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,,GlanceLauncher.exe,Glance Launcher*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Glance,,GProtocolHandler.exe,Glance Networks*,,TRUE,RMM,https://help.glance.cx/security/security_qa/,11/20/2024 -Microsoft SCCM Remote Control,user_managed,sccmrdpsystem.exe,SCCM RDP System,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,sccmrdpuser.exe,Microsoft Configuration Manager Remote Control,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,cmrcservice.exe,Configuration Manager Remote Control Service,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -Microsoft SCCM Remote Control,,cmrcviewer.exe,ConfigMgr Remote Control Viewer,,TRUE,RMM,https://learn.microsoft.com/en-us/mem/configmgr/core/clients/manage/remote-control/introduction-to-remote-control,1/29/2025 -NexThink,*.data.us.nexthink.cloud,nxtsvc.exe,Nexthink Collector*,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.eu.nexthink.cloud,nxtcod.exe,Nexthink Coordinator*,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.pac.nexthink.cloud,nxtcoordinator.exe,,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 -NexThink,*.data.meta.nexthink.cloud,nxtupdater.exe,,,TRUE,RMM,https://docs.nexthink.com/platform/getting-started/planning-your-installation/techical-requirements/connectivity-requirements,1/24/2025 +app,"match_pattern",domain,"file_path","file_name","file_info",category,reference,description +"247ithelp.com (ConnectWise)","247ithelp.com*",,,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)","ConnectWise*",,,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)",,"*.247ithelp.com",,,,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"247ithelp.com (ConnectWise)",,,,"Remote Workforce Client.exe",,RMM,"","247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)","Absolute*",,,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)","Computrace*",,,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"*.search.namequery.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"*.server.absolute.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"search.namequery.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,"server.absolute.com",,,,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"ctes.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"cteshostsvc.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"ctespersistence.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"rpcld.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,"rpcnet.exe",,RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"Absolute Persistence*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"CTES*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Absolute (Computrace)",,,,,"Absolute Software*",RMM,"https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com","Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC","Access Remote PC*",,,,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC","AccessRemotePC*",,,,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Access Remote PC",,,"C:\Program Files (x86)\RemotePC\*",,,RMM,"","Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","Acronis Cyber Protect*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","AcronisCyberProtect*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)","Remotix*",,,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"agents*-cloud.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"cloud.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"connect.acronis.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,"gw.remotix.com",,,,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,"AcronisCyberProtectConnectAgent.exe",,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,"AcronisCyberProtectConnectQuickAssist*.exe",,RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,,"Acronis Cyber Protect Connect Agent",RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Acronis Cyber Protect (Remotix)",,,,,"Acronis Cyber Protect Connect Quick Assist",RMM,"https://kb.acronis.com/content/47189","Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Action1,"Action1*",,,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,"*.action1.com",,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,"a1-backend-packages.s3.amazonaws.com",,,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,,"C:\Windows\Action1\*",,,RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Action1,,,,,"Action1*",RMM,"https://www.action1.com/documentation/firewall-configuration/,https://www.action1.com/documentation/,https://twitter.com/Kostastsale/status/1646256901506605063?s=20,https://ruler-project.github.io/ruler-project/RULER/remote/Action1/","Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed." +Addigy,"Addigy*",,,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"agents.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"grtmprod.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,"prod.addigy.com",,,,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,,,"addigy-*.pkg",,RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Addigy,,,,,"Addigy*",RMM,"https://addigy.com/","Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,"AeroAdmin*",,,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,"aeroadmin.com",,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,"auth*.aeroadmin.com",,,,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,"AeroAdmin.exe",,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,"aeroadmin.exe",,RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,,"Aero Admin*",RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AeroAdmin,,,,,"AeroAdmin*",RMM,"https://support.aeroadmin.com/kb/faq.php?id=58","AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control","AliWangWang-remote-control*",,,,,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,"wangwang.taobao.com",,,,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,,,"alitask.exe",,RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"AliWangWang-remote-control",,,,,"AliWangWang*",RMM,"https://github.com/KKomarov/AliWangWangEng/blob/master/chs.locale","AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Allocentra,"Allocentra*",,,,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,"api.allocentra.co.za",,,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,,"C:\Program Files\Allocentra\Agent\allocentra-agent.exe",,,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Allocentra,,,,"allocentra-agent.exe",,RMM,"https://allocentra.co.za/,https://docs.allocentra.co.za/agent-installation,https://docs.allocentra.co.za/remote-control,https://docs.allocentra.co.za/scripts,https://docs.allocentra.co.za/patches","Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions." +Alpemix,"Alpemix*",,,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,"*.alpemix.com",,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,"*.teknopars.com",,,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,"C:\AlpemixService.exe",,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,"C:\AlpemixSrvc\",,,RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,,,"Teknopars*",RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Alpemix,,,,,"Alpemix*",RMM,"https://www.alpemix.com/en/remote-access","Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support","Any Support*",,,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support","AnySupport*",,,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,"*.anysupport.net",,,,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,"ManualLauncher.exe",,RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"Koino Co.",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"Ltd.",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Any Support",,,,,"AnySupport*",RMM,"https://www.anysupport.net/introduce_howto.php","Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyDesk,"AnyDesk*",,,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"*.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"boot.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,"relay-*.net.anydesk.com",,,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"/Applications/AnyDesk.app",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk-*\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk-*\AnyDesk-*.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files (x86)\AnyDesk\AnyDesk.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files\AnyDesk-*\AnyDesk-*.exe",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,"C:\Program Files\AnyDesk\*",,,RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,,,"philandro Software*",RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyDesk,,,,,"anydesk*",RMM,"https://support.anydesk.com/docs/settings,https://support.anydesk.com/docs/advanced-options,https://support.anydesk.com/docs/unattended-access,https://support.anydesk.com/docs/command-line-interface-for-windows,https://support.anydesk.com/docs/change-of-installation-directory-for-windows-custom-clients,https://support.anydesk.com/docs/what-are-trace-files,https://support.anydesk.com/docs/firewall,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/mthcht/awesome-lists/tree/79ced75eebe53bcabf1235b3c17eb11788875482/Lists/RMM/anydesk,https://ruler-project.github.io/ruler-project/RULER/remote/AnyDesk/,https://newsletter.securityinbits.com/p/32-ransomware-groups-abuse-anydesk,https://github.com/magicsword-io/LOLRMM/issues/247","AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams." +AnyViewer,"AnyViewer*",,,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,"*.anyviewer.com",,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,"*.aomeisoftware.com",,,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,"C:\Program Files (x86)\AnyViewer\*",,,RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,,,"Anyviewer*",RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AnyViewer,,,,,"AOMEI*",RMM,"https://www.anyviewer.com/how-to/how-to-open-firewall-ports-for-remote-desktop-0427-gc.html,https://www.anyviewer.com/help/remote-technical-support.html","AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control","Anyplace Control*",,,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control","AnyplaceControl*",,,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,"anyplace-control.com",,,,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,,,"apc_host.exe",,RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Anyplace Control",,,,,"Anyplace*",RMM,"http://www.anyplace-control.com/anyplace-control/help/faq.htm","Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Aspia,"Aspia*",,,,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"*\aspia_client.exe",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"C:\Program Files (x86)\Aspia\",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Aspia,,,"C:\Program Files\Aspia\",,,RMM,"https://ics-cert.kaspersky.com/publications/reports/2025/06/05/ttps-of-cyber-partisans-activity-aimed-at-espionage-and-disruption/,https://www.aspia.org/,https://github.com/dchapyshev/aspia","Aspia is an open-source Remote Desktop, file transfer and system information tool." +Atera,"Atera*",,,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agent-api.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agenthb.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agentreporting.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"agentreportingstore.blob.core.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"app.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"appcdn.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"atera-agent-heartbeat.servicebus.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"atera.pubnubapi.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"getalphacontrol.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"packagesstore.blob.core.windows.net",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"ps.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,"pubsub.atera.com",,,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\ATERA Networks\AteraAgent\*",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AgentPackageNetworkDiscovery.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AgentPackageTaskScheduler.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"*\AteraAgent.exe",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files (x86)\Atera Networks",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files\ATERA Networks\AteraAgent\*",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,"C:\Program Files\Atera Networks",,,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"atera_agent.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"ateraagent.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,"syncrosetup.exe",,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,,AteraAgent,RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Atera,,,,,"Atera Networks",RMM,"https://support.atera.com/hc/en-us/articles/360015461139-Firewall-Settings-for-Atera-s-Integrations,https://support.atera.com/hc/en-us/articles/215955967-Troubleshoot-Atera-s-Windows-agent,https://support.atera.com/hc/en-us/articles/115015619747-Release-Notes-February-2018,https://thedfirreport.com/?s=ateraagent,https://www.pubnub.com/docs/general/setup/connection-management","Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement." +Auvik,"Auvik*",,,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"*.auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"*.my.auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,"auvik.com",,,,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,,,"auvik.agent.exe",,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Auvik,,,,"auvik.engine.exe",,RMM,"https://support.auvik.com/hc/en-us/articles/204315700-What-protocols-and-ports-does-the-Auvik-collector-use","Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,"AweRay*",,,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,"asapi*.aweray.net",,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,"client-api.aweray.com",,,,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,"AweSun.exe",,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,"aweray_remote*.exe",,RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,,"AweSun*",RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +AweRay,,,,,"AweRay*",RMM,"https://sun.aweray.com/help","AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,"Barracuda*",,,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"*.islonline.net",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"barracudamsp.com",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,"rmm.barracudamsp.com",,,,RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"Barracuda Networks",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"LPI Level Platforms",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Barracuda,,,,,"Barracuda MSP",RMM,"https://help.islonline.com/19799/166125","Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Basecamp,"Basecamp*",,,,,RAT,"","Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Basecamp,,"basecamp.com",,,,RAT,"","Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Basic RMM Agent","Basic RMM Agent*",,,,,RMM,"","Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage." +"Basic RMM Agent","BasicRMMAgent*",,,,,RMM,"","Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage." +BeAnyWhere,"BeAnyWhere*",,,,,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,"beanywhere.com",,,,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupApp.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupAppElev.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupAppSrvc.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"BASupSysInf.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"TakeControl.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basupsrvc.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basupsrvcupdate.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeAnyWhere,,,,"basuptshelper.exe",,RMM,"https://www.shouldiremoveit.com/beanywhere-support-service-40908-program.aspx","BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,"BeInSync*",,,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,"*.beinsync.com",,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,"*.beinsync.net",,,,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,"Beinsync*.exe",,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,,"BeInSync Client GUI",RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeInSync,,,,,BeInSync,RAT,"https://en.wikipedia.org/wiki/Phoenix_Technologies","BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Beacon (Synertek)","Beacon*",,,,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)","Synertek*",,,,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/Application Support/Beacon/agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/Application Support/Beacon/credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/Library/LaunchDaemons/com.beacon.agent.plist",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/beacon/agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/beacon/credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/etc/systemd/system/beacon-agent.service",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/usr/local/bin/beacon-agent",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"/var/log/beacon-agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\Program Files\Beacon\beacon-agent.exe",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\ProgramData\Beacon\agent.log",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +"Beacon (Synertek)",,,"C:\ProgramData\Beacon\credential.json",,,RMM,"https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/README.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/docs/BETA_PLATFORM_SUPPORT.md,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_windows.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/service/install_unix.go,https://github.com/synertek-cloud-services/beacon/blob/e3b790b72d18ed6243cc18759839ee2059022f6a/agent/internal/credential/store.go","Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +BeamYourScreen,"BeamYourScreen*",,,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,"*.beamyourscreen.com",,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,"beamyourscreen.com",,,,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,"beamyourscreen-host.exe",,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,"beamyourscreen.exe",,RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeamYourScreen,,,,,"BeamYourScreen*",RMM,"https://www.mikogo.com/","BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +BeyondTrust,"BeyondTrust*",,,,,RMM,"","BeyondTrust is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)","BeyondTrust*",,,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)","Bomgar*",,,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"*.beyondtrustcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"*.bomgarcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,"bomgarcloud.com",,,,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-pac-*.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-pac.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-rdp.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-scc-*.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,"bomgar-scc.exe",,RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,,"Bomgar*",RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BeyondTrust (Bomgar)",,,,,"BeyondTrust*",RMM,"https://www.beyondtrust.com/docs/remote-support/getting-started/deployment/cloud/network.htm","BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"BlackCrypt RMM Agent","BlackCrypt RMM Agent*",,,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"BlackCrypt RMM Agent","BlackCryptRMMAgent*",,,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"BlackCrypt RMM Agent",,"blackcryptknight.com",,,,RMM,"","BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +Borealis,"Borealis*",,,,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent-updater.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent-watchdog.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/etc/systemd/system/borealis-agent.service",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/Agent",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/Logs/Agent/agent.log",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"/opt/Borealis/Agent/agent.json",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\*",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\Logs\Agent\agent.log",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Borealis,,,"C:\Borealis\agent.json",,,RMM,"https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/README.md,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/build-agent.sh,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_windows.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/internal/runtime/service_unix.go,https://github.com/bunny-lab-io/Borealis/blob/19288159199132f29d276e4dbbbfa694807987ff/Data/Agent/cmd/agent/bootstrap-config.go","Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +BreezeRMM,"BreezeRMM*",,,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"breezermm.com",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"eu.2breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,"us.2breeze.app",,,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/Application Support/Breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchAgents/com.breeze.desktop-helper-loginwindow.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchAgents/com.breeze.desktop-helper-user.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchDaemons/com.breeze.agent.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/LaunchDaemons/com.breeze.watchdog.plist",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/Library/Logs/Breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/etc/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/etc/systemd/system/breeze-agent.service",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-agent",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-backup",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-desktop-helper",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/usr/local/bin/breeze-watchdog",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/var/lib/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"/var/log/breeze/*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"C:\Program Files\Breeze\*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,"C:\ProgramData\Breeze\*",,,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +BreezeRMM,,,,"PixoIT-agent.exe",,RMM,"https://breezermm.com/,https://breeze.app/,https://github.com/LanternOps/breeze,https://github.com/LanternOps/breeze/releases/tag/v0.115.0,https://github.com/LanternOps/breeze/blob/v0.115.0/agent/scripts/install/install-linux.sh,https://bazaar.abuse.ch/sample/52dd8b2f9145907477a6ebc4ad406c1e4b221ea967f1c2ce8bc23faa83b663d8/,https://github.com/magicsword-io/LOLRMM/issues/235","BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established." +"CHAOS RAT","CHAOS RAT*",,,,,RAT,"https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/README.md,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/services/client/client_service.go,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/infrastructure/websocket/client.go,https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/","CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use." +"CHAOS RAT","CHAOSRAT*",,,,,RAT,"https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/README.md,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/services/client/client_service.go,https://github.com/tiagorlampert/CHAOS/blob/55d14b203bc1444498ee0c2b96a1ab3304d99d77/client/app/infrastructure/websocket/client.go,https://www.acronis.com/en/tru/posts/from-open-source-to-open-threat-tracking-chaos-rats-evolution/","CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use." +"CentraStage (Datto)","CentraStage*",,,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)","Datto*",,,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"*.cc.centrastage.net",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"*.rmm.datto.com",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,"cc.centrastage.net",,,,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,"AEMAgent.exe",,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,"CagService.exe",,RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CentraStage (Datto)",,,,,"Datto*",RMM,"https://rmm.datto.com/help/de/Content/1INTRODUCTION/Requirements/AllowListRequirements.htm","CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,"Centurion*",,,,,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,,"centuriontech.com",,,,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Centurion,,,,"ctiserv.exe",,RMM,"https://data443.atlassian.net/servicedesk/customer/portal/20","Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chicken (of the VNC)","Chicken*",,,,,RAT,"https://github.com/flit/cotvnc","Chicken (of the VNC) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome Remote Desktop","Chrome Remote Desktop*",,,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop","ChromeRemoteDesktop*",,,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"*.remotedesktop-pa.googleapis.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"*.remotedesktop.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-client.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-host.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"chromoting-oauth.talkgadget.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"remotedesktop-pa.googleapis.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,"remotedesktop.google.com",,,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"*\Google\Chrome Remote Desktop\*",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"*\remoting_host.exe",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/Library/PrivilegedHelperTools/ChromeRemoteDesktopHost.app/Contents/MacOS/remoting_me2me_host_service",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/opt/google/chrome-remote-desktop/chrome-remote-desktop",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"/opt/google/chrome-remote-desktop/chrome-remote-desktop-host",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,"C:\Program Files (x86)\Google\Chrome Remote Desktop\*",,,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,,"remoting_host.exe",,RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome Remote Desktop",,,,,"Chrome Remote Desktop",RAT,"https://support.google.com/chrome/a/answer/2799701?hl=en,https://support.google.com/chrome/answer/1649523,https://support.google.com/chrome/a/thread/154474130,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/branding_Chrome,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/Scripts/remoting_postflight.sh,https://chromium.googlesource.com/chromium/src/+/HEAD/remoting/host/installer/mac/LaunchAgents/org.chromium.chromoting.plist,https://dl.google.com/linux/direct/chrome-remote-desktop_current_amd64.deb,https://github.com/magicsword-io/LOLRMM/issues/230,https://www.virustotal.com/gui/file/1e0fbe101bbca4efdfb05c012495265f1db731c97fb82fa8e569c6ab725c0140","Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context." +"Chrome SSH Extension","Chrome SSH Extension*",,,,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension","ChromeSSHExtension*",,,,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension",,,"*Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd*",,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Chrome SSH Extension",,,"C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd*",,,RAT,"","Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CloudFlare Tunnel","CloudFlare Tunnel*",,,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel","CloudFlareTunnel*",,,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"*.cfargotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"*.trycloudflare.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"_v2-origintunneld._tcp.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"api.cloudflare.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"h2.cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"quic.cftunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"region1.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"region2.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"update.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"us-region1.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,"us-region2.v2.argotunnel.com",,,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,"C:\Program Files (x86)\cloudflared\cloudflared.exe",,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,"C:\Program Files\cloudflared\cloudflared.exe",,,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"CloudFlare Tunnel",,,,"cloudflared.exe",,RAT,"https://cloudflare.com/products/tunnel/,https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/,https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/,https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/windows/,https://github.com/cloudflare/cloudflared/blob/master/cmd/cloudflared/windows_service.go,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it." +"Comodo RMM","Comodo RMM*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM","ComodoRMM*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"*.itsm-us1.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"*.mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,"one.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,,,"itsmagent.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Comodo RMM",,,,"rviewer.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,"ConnectWise*",,,,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,"*\ScreenConnect*Client*\*",,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,"C:\Program Files (x86)\ScreenConnect Client ()\*",,,RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"CONTINUUM MANAGED*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"ScreenConnect*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ConnectWise,,,,,"ConnectWise*",RMM,"","ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control","ConnectWise Control*",,,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control","ConnectWiseControl*",,,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,"control.connectwise.com",,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,"live.screenconnect.com",,,,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"connectwisechat-customer.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"connectwisecontrol.client.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,"screenconnect.windowsclient.exe",,RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"CONTINUUM MANAGED*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"ScreenConnect*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ConnectWise Control",,,,,"ConnectWise*",RMM,"","ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","Connectwise Automate*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","ConnectwiseAutomate*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)","LabTech*",,,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,"*.hostedrmm.com",,,,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"ltsvc.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"ltsvcmon.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Connectwise Automate (LabTech)",,,,"lttray.exe",,RMM,"https://www.connectwise.com/company/announcements/labtech-now-connectwise-automate","Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ControlR,"ControlR*",,,,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,"demo.controlr.app",,,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Applications/ControlR.*.app",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Applications/ControlR.app",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/Library/Application Support/ControlR/*",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"/usr/local/bin/ControlR/*",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\ControlR.Agent.exe",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.dll",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\Program Files\ControlR\*\DesktopClient\ControlR.DesktopClient.exe",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +ControlR,,,"C:\ProgramData\ControlR\",,,RMM,"https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/,https://controlr.app/,https://github.com/bitbound/ControlR","ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems." +Controlio,"Controlio*",,,,,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,"C:\ProgramData\{E0E95C6C-F194-4846-928D-E5538022226D}\",,,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"bbl.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"libeay32.dll",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"ssleay32.dll",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weCliboardListener.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weInstSvc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wec_launcher_[a-Z0-9]*_.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wec_launcher_[a-Z0-9]*_.pkg",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wemonc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"weprtct.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +Controlio,,,,"wesvc.exe",,RMM,"https://controlio.net,https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html,https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio,https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client","Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +CrossLoop,"CrossLoop*",,,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,"*.crossloop.com",,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,"crossloop.en.softonic.com",,,,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"CrossLoopConnect.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"WinVNCStub.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,"crossloopservice.exe",,RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +CrossLoop,,,,,"Crossloop*",RMM,"","CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"CrossTec Remote Control","CrossTec Remote Control*",,,,,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control","CrossTecRemoteControl*",,,,,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,"PCIVIDEO.EXE",,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,"supporttool.exe",,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"CrossTec Remote Control",,,,,CrossTec,RMM,"https://www.crosstecsoftware.com/supporthome.html","CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only." +CruzControl,"CruzControl*",,,,,RMM,"https://resources.doradosoftware.com/cruz-rmm","CruzControl is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service","DW Service*",,,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service","DWService*",,,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,"*.dwservice.net",,,,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwagent.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwaglnc.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,"dwagsvc.exe",,RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"DW Service",,,,,"DWSNET*",RMM,"https://news.dwservice.net/dwservice-security-infrastructure/,https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/","DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,"DameWare*",,,,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,"dameware.com",,,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"*\dwrcs\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"*\dwrcst.exe",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"C:\Program Files\SolarWinds\Dameware Mini Remote Control\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,"C:\Windows\dwrcs\*",,,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"DameWare Mini Remote Control*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"DameWare Remote Support.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"SolarWinds-Dameware-DRS*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"SolarWinds-Dameware-MRC*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"dntus*.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,"dwrcs.exe",,RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DameWare,,,,,"DameWare*",RMM,"https://documentation.solarwinds.com/en/success_center/dameware/content/install-standalone-port-requirements.htm","DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Dataplicity,"Dataplicity*",,,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"*.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"*.wormhole.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,"www.dataplicity.com",,,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/etc/init.d/dataplicity",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/etc/systemd/system/dataplicity.service",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/opt/dataplicity/*",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/opt/dataplicity/tuxtunnel/*",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +Dataplicity,,,"/usr/local/bin/dataplicity",,,RAT,"https://www.dataplicity.com/,https://github.com/wildfoundry/dataplicity-agent,https://lottunnels.github.io/lottunnels/Binaries/dataplicity/","Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, ""Wormhole"" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the ""shell access"" category for exactly this abuse profile." +DeskDay,"DeskDay*",,,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,"app.deskday.ai",,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,"deskday.ai",,,,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskDay,,,,"ultimate_*.exe",,RMM,"https://support.deskday.ai/en/articles/8235973-installing-the-end-user-application-ultimate","DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskNets,"DeskNets*",,,,,RMM,"https://www.desknets.com/en/download.html","DeskNets is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,"DeskShare*",,,,,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,"DSGuest.exe",,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,"TeamTaskManager.exe",,RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,,"DeskShare*",RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DeskShare,,,,,"Team Task Manager*",RMM,"https://www.deskshare.com/help/fml/Active-and-Passive-connection-mode.aspx","DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,"DesktopNow*",,,,,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,"*.nchuser.com",,,,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,"desktopnow.exe",,RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,,"NCH Software*",RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DesktopNow,,,,,"DesktopNow*",RMM,"https://forums.ivanti.com/s/article/Network-Ports-used-by-Environment-Manager?language=en_US","DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","Dev Tunnels*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","DevTunnels*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Dev Tunnels (aka Visual Studio Dev Tunnel)","aka Visual Studio Dev Tunnel*",,,,,RAT,"","Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager","Devolutions Remote Desktop Manager*",,,,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager","DevolutionsRemoteDesktopManager*",,,,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,"*\RemoteDesktopManager.exe",,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,"C:\Program Files\Devolutions\Remote Desktop Manager",,,RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,,,"Remote Desktop Manager",RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Devolutions Remote Desktop Manager",,,,,"Devolutions inc",RAT,"https://devolutions.net/remote-desktop-manager/,https://ogmini.github.io/research#remote-desktop-manager","Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop","Distant Desktop*",,,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop","DistantDesktop*",,,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"*.distantdesktop.com",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"*.signalserver.xyz",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,"signalserver.xyz",,,,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"dd.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"ddsystem.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,"distant-desktop.exe",,RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"Distant Desktop*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"German Gorodokuplya*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Distant Desktop",,,,,"Distant Software*",RMM,"https://www.distantdesktop.com/manual/first-start.htm","Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,"Domotz*",,,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"*.cell-1.domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"*.domotz.co",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"cell-1.domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,"domotz.com",,,,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"Domotz Pro Desktop App Setup*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"Domotz Pro Desktop App.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz-windows*.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,"domotz_bash.exe",,RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Domotz,,,,,"Domotz*",RMM,"https://help.domotz.com/tips-tricks/unblock-outgoing-connections-on-firewall/","Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,"DragonDisk*",,,,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"*\Almageste\DragonDisk\*",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"*\DragonDisk.exe",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +DragonDisk,,,"C:\Program Files (x86)\Almageste\DragonDisk\*",,,RAT,"","DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Duet Display","Duet Display*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display","DuetDisplay*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"*.duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"*.itagent.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"itagent.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,"rdp.duetdisplay.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"DuetDisp.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"DuetSetup.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +"Duet Display",,,,"duet.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/125,https://www.duetdisplay.com/remote-desktop-access-software,https://www.itagent.com/it-agent-remote-access","Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose." +Duplicati,"Duplicati*",,,,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Duplicati,,,"*\*\Duplicati.Server.exe",,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Duplicati,,,"c:\Program Files\*\Duplicati.Server.exe",,,RAT,"","Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console","EMCO Remote Console*",,,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console","EMCORemoteConsole*",,,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console",,"emcosoftware.com",,,,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"EMCO Remote Console",,,,"remoteconsole.exe",,RMM,"","EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator","ESET Remote Administrator*",,,,,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator","ESETRemoteAdministrator*",,,,,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"ERAAgent.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"einstaller.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"era.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"eratool.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,"ezhelp*.exe",,RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ESET Remote Administrator",,,,,"ESET Management*",RMM,"https://eset.com/me/business/remote-management/remote-administrator/","ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,"Echoware*",,,,,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,,,,"echoserver*.exe",,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Echoware,,,,"echoware.dll",,RMM,"","Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)","Electric AI*",,,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)","ElectricAI*",,,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Electric AI (Kaseya)",,"electric.ai",,,,RMM,"https://www.electric.ai/product/device-management-solutions - Usess Kaseya/jamf","Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Encapto,"Encapto*",,,,,RMM,"https://www.encapto.com - used to manage Cisco services","Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Encapto,,"encapto.com",,,,RMM,"https://www.encapto.com - used to manage Cisco services","Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Endar,"Endar*",,,,,RMM,"https://github.com/tomkeene/endar,https://github.com/tomkeene/endar/blob/359a4495cd13711c82419e944abee14cb5c04979/README.md,https://github.com/tomkeene/endar/blob/359a4495cd13711c82419e944abee14cb5c04979/app/agent_api_v1/views.py,https://github.com/tomkeene/endar/releases/tag/1.0.0,https://github.com/tomkeene/endar/releases/download/1.0.0/endar.exe","Endar is an open-source, self-hosted RMM platform focused on endpoint monitoring and compliance policies. Its controller source exposes agent registration, policy retrieval, compliance-result, and data-collection endpoints. Static extraction of the sole GitHub 1.0.0 release asset identifies a Linux x86-64 PyInstaller endpoint agent with registration, policy, data-collection, and compliance-task code. The source for that agent is not in the repository, and the asset does not establish a default installation directory or service; this entry records only supported release evidence." +"Ericom AccessNow","Ericom AccessNow*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow","EricomAccessNow*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,"ericom.com",,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,,,"accessserver*.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom AccessNow",,,,"accessserver.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect","Ericom Connect*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect","EricomConnect*",,,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,"ericom.com",,,,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,,,"EricomConnectRemoteHost*.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ericom Connect",,,,"ericomconnectconfigurationtool.exe",,RMM,"https://www.ericom.com/connect-accessnow/","Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,"ExtraPuTTY*",,,,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"*Users\*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ExtraPuTTY,,,"C:\Users\*\ExtraPuTTY-0.30-2016-01-28-installer.exe",,,RAT,"","ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Faronics Core","Faronics Core*",,,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core","FaronicsCore*",,,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"faronics.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"*\Faronics\Faronics Core\Workstation Agent\CoreAgentService.exe",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"*\Faronics\Faronics Core\Workstation Agent\FaronicsCoreAgent.exe",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files (x86)\Faronics\Faronics Core\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Core\Console\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Faronics Core\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\Program Files\Faronics\Faronics Core\Workstation Agent\*",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,"C:\ProgramData\Faronics\FCAForStartupMonitor.msi",,,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,,"CoreAgentService.exe",,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Core",,,,"FaronicsCoreAgent.exe",,RMM,"https://www.faronics.com/products/faronics-core,https://www.faronics.com/assets/FCC_Manual.pdf,https://www.faronics.com/document-library/document/faronics-core-release-notes,https://www.virustotal.com/gui/file/6f78a2dc13eaf007bd83cdda91ff4d53e737e0b7205d1ae9e38f2bfd831fdb6d","Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze","Faronics Deep Freeze*",,,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze","FaronicsDeepFreeze*",,,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"cloud.faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"deepfreeze.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"faronicscloud.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"www.deepfreeze.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFC.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFServ.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFServEx.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"*\Faronics\Deep Freeze\DFWks.exe",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\Install C-0\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files (x86)\Faronics\Deep Freeze\Install C-1\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files\Faronics Corporation\Deep Freeze 7.00\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,"C:\Program Files\Faronics\Deep Freeze\*",,,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"CloudWksInstall.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFC.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFInst.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFServ.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFServEx.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFStd.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFStdInstall.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deep Freeze",,,,"DFWks.exe",,RMM,"https://www.faronics.com/products/deep-freeze,https://docs.faronics.com/deep-freeze-cloud,https://www.faronics.com/webhelp/DFE/860/EN/Chapter.1.108.html,https://www.faronics.com/document-library/document/deep-freeze-msi-packager,https://faronicscloud.com/blogs/news/what-is-faronics-cloud-a-complete-guide-to-cloud-endpoint-management,https://www.virustotal.com/gui/file/c699e5b33564c03d65e22a272d9164fc8a2e46822d792564fb52d3b45fb5a1e4,https://www.virustotal.com/gui/file/48f35f01c04192e39b9e51850792e5fbc1a9df31e0f61ab505b1c1c30aaa0b36","Faronics Deep Freeze is a ""reboot-to-restore"" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151." +"Faronics Deploy","Faronics Deploy*",,,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy","FaronicsDeploy*",,,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"1wuccjc4a3.execute-api.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"29qoj3q0yf.execute-api.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"8z5x4rqbxi.execute-api.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"deploy.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"docs.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics-deploy-int-production-installers.s3.eu-west-1.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics-deploy-na-production-installers.s3.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"faronicscloud.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"nv0mddxkh7.execute-api.us-west-2.amazonaws.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-ap-southeast-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-ca-central-1.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-eu-west-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-sa-east-1.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-us-east-1.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"remotepro-us-west-2.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"support.faronics.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"upd.faronicslabs.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,"www.faronicsdeploy.com",,,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\*",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsDeployAgent.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,"C:\ProgramData\Faronics\StorageSpace\FWA\*",,,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"CloudWksInstall.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWAService.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWAWebInstaller_*.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FWA_UI_Agent.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Deploy",,,,"FaronicsDeployAgent.exe",,RMM,"https://www.faronics.com/products/deploy,https://docs.faronics.com/faronicsdeploy,https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide,https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy,https://www.faronics.com/deploy/remote-control,https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4,https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9,https://www.huntress.com/blog/faronics-deploy-abuse,https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/","Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session (""Remote Pro""). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution." +"Faronics Insight","Faronics Insight*",,,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight","FaronicsInsight*",,,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"docs.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"support.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,"www.faronics.com",,,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentAgent.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentSvc.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\FIStudentUI.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Student\STAHelper.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"*\Faronics\Insight Teacher\STAHelper.exe",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files (x86)\Faronics\Insight Student\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files (x86)\Faronics\Insight Teacher\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files\Faronics\Insight Student\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,"C:\Program Files\Faronics\Insight Teacher\*",,,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentAgent.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentSvc.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"FIStudentUI.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstaller.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstallerStudent.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightInstallerTeacher.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"InsightSetup.msi",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"STAHelper.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +"Faronics Insight",,,,"StudentSvc.exe",,RMM,"https://www.faronics.com/products/insight,https://docs.faronics.com/faronics-insight-docs,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student,https://docs.faronics.com/faronics-insight-docs/installation-and-administration/installation/installing-on-windows/installing-the-insight-student/command-line-installation,https://www.faronics.com/assets/INS_Manual.pdf,https://www.virustotal.com/gui/file/7c9436a2cb59e4de9dab8b0a72ce874ddae448dce47b5e07d95d221fffba3ba7,https://www.virustotal.com/gui/file/647a06a3ab62d848ed5f0e5853825dc8c97954b766ed8c710ec0a1608971a61b","Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151." +FastViewer,"FastViewer*",,,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,"*.fastviewer.com",,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,"fastviewer.com",,,,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"FastViewer.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"fastclient.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,"fastmaster.exe",,RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FastViewer,,,,,"Fastviewer*",RMM,"https://fastviewer.com/demo/EN_FastViewer_Server%20Installation%20Configuration.pdf","FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it","FixMe.it*",,,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"*.fixme.it",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"*.techinline.net",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,"fixme.it",,,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,9380CC75B872221A7425D7503565B67580407F60,,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Client.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Expert Setup.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeit Unattended Access Setup.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"FixMeitClient*.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiClientCore.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiClientHelper*.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiExpertCore.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"TiExpertStandalone.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,"fixmeitclient.exe",,RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"FixMe.IT Helper",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"SetMe*",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FixMe.it",,,,,"FixMe*",RMM,"https://docs.fixme.it/general-questions/which-ports-and-servers-does-fixme-it-use","FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"FleetDeck.io","FleetDeck.io*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"*.fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"agentmqtt.fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"checkip.zmazonaws.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,"fleetdeck.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\*\fd_agent.dll",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\*\fleetdeck_agent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,"C:\Windows\Temp\FleetDeck\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.msi",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck-agent.mst",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_agent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_agent_svc.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_commander_launcher.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_commander_svc.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,"fleetdeck_installer.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +"FleetDeck.io",,,,,"FleetDeck*",RMM,"https://github.com/magicsword-io/LOLRMM/issues/112,https://fleetdeck.io/faq/","FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations." +Fortra,"Fortra*",,,,,RMM,"https://www.fortra.com - No free/cloud RMM softwars listed","Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Fortra,,"fortra.com",,,,RMM,"https://www.fortra.com - No free/cloud RMM softwars listed","Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool","Free Ping Tool*",,,,,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool","FreePingTool*",,,,,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Ping Tool",,,,"can't find this one",,RAT,"","Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher","Free Tools Launcher*",,,,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher","FreeToolsLauncher*",,,,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher",,,"*\ManageEngine\*",,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Free Tools Launcher",,,"C:\Program Files\ManageEngine\ManageEngine Free Tools\Launcher\*",,,RMM,"","Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,"FreeNX*",,,,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,,,"*\nxplayer.exe",,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +FreeNX,,,"C:\*\nxplayer.exe",,,RAT,"","FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Freshservice,"Freshservice*",,,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.fdcollab.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshcloud.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshconnect.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshdev.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshworks.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.freshworksapi.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.in-freshbots.ai",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.myfreshworks.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.rtschannel.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"*.webpush.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"api.fdcollab.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"apicdn-wchat.freshchat.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"freshasset.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"fstools.freshasset.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"fstools.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"static.freshdev.io",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,"www.freshservice.com",,,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSAgentAutoUpdate.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSAgentService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\FSWmiScanner.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\Freshservice.DiscoveryProbe.ScanService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"*\Freshservice.DiscoveryProbe.Window.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\FSAgentAutoUpdate.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\FSAgentService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\bin\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshdesk\Freshservice Discovery Agent\conf\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\Freshservice.DiscoveryProbe.ScanService.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\Freshservice.DiscoveryProbe.Window.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\bin\plink.exe",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\conf\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\db\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\nmap\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,"C:\Program Files (x86)\Freshworks\FreshServiceProbe\tools\ssh\*",,,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"FSAgent.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"fs-probe-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"fs-windows-agent-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +Freshservice,,,,"win-installer-*.msi",,RMM,"https://www.freshworks.com/freshservice/,https://support.freshservice.com/support/solutions/articles/200393-freshservice-discovery-agent,https://support.freshservice.com/support/solutions/articles/223635-installing-discovery-agent-windows-,https://support.freshservice.com/support/solutions/articles/199849-installing-discovery-agent-win-in-a-domain-using-gpo-,https://support.freshservice.com/support/solutions/articles/199805-installing-discovery-agent-win-in-a-workgroup-using-psexec-,https://support.freshservice.com/support/solutions/articles/158679-freshservice-discovery-probe,https://support.freshservice.com/support/solutions/articles/158680-downloading-and-installing-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/158681-configuring-the-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004929-software-requirements-for-discovery-probe,https://support.freshservice.com/support/solutions/articles/50000004074-about-discovery-probe-security,https://support.freshservice.com/support/solutions/articles/234412-freshdesk-domains-to-whitelist-in-your-firewall,https://www.virustotal.com/gui/file/773f976170f87167d63d55bf83c5f3853d3f10f01dd627ab3dfe0f02b6f25d48,https://www.virustotal.com/gui/file/20ca682b3485bc5e9b407749fbc42c7b4148c3d6f00c17eab52e9a85bcc1e299,https://www.virustotal.com/gui/file/ae7da71392831894071da4464588713db5fb3babdf5f1d0d88ae7927d3c19179,https://www.virustotal.com/gui/file/16bdb59cb9772a6b8d430d7bc4811c89548aa68aeb833b41f49ce58efcaad48a,https://www.virustotal.com/gui/domain/fstools.freshservice.com,https://www.virustotal.com/gui/domain/freshservice.com","Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by ""Freshworks Inc"" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks ""Switchboard""/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services." +"GLPI Agent","GLPI Agent*",,,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent","GLPIAgent*",,,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"forum.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"github.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"glpi-network.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"nightly.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"objects.githubusercontent.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"services.glpi-network.com",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,"www.glpi-project.org",,,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/Applications/GLPI-Agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/Applications/GLPI-Agent/etc/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/etc/glpi-agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/usr/bin/glpi-agent",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/usr/local/bin/glpi-agent",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"/var/lib/glpi-agent/*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\etc\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\logs\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\perl\bin\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GLPI Agent",,,"C:\Program Files\GLPI-Agent\var\*",,,RMM,"https://glpi-project.org/,https://github.com/glpi-project/glpi-agent,https://glpi-agent.readthedocs.io/en/latest/,https://glpi-agent.readthedocs.io/en/latest/installation/index.html,https://glpi-agent.readthedocs.io/en/latest/installation/windows-command-line.html,https://glpi-agent.readthedocs.io/en/latest/installation/linux-appimage.html,https://glpi-agent.readthedocs.io/en/latest/configuration.html,https://glpi-agent.readthedocs.io/en/latest/man/glpi-win32-service.html,https://glpi-agent.readthedocs.io/en/latest/man/index.html,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/unix/glpi-agent.service,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/glpi-agent-deployment.vbs,https://github.com/glpi-project/glpi-agent/blob/develop/contrib/windows/packaging/MSI_main-v2.wxs.tt,https://github.com/glpi-project/glpi-agent/releases/latest,https://www.virustotal.com/gui/file/db2661a14359931a2d14ed7268f9b90763da4f2bec97b5ed8d51b9bb655d730c","GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers." +"GO RMM","GO RMM*",,,,,RMM,"","GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse." +"GO RMM","GORMM*",,,,,RMM,"","GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse." +"GatherPlace-desktop sharing","GatherPlace-desktop sharing*",,,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing","GatherPlace-desktopsharing*",,,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"*.gatherplace.com",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"*.gatherplace.net",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,"gatherplace.com",,,,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp3.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp4.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,"gp5.exe",,RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GatherPlace-desktop sharing",,,,,"Gatherworks*",RMM,"https://www.gatherplace.com/kb?id=136377","GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GetScreen,"GetScreen*",,,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"*.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"GetScreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"go.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"image.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,"px-*.getscreen.me",,,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Program Files\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\ProgramData\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\AppData\Local\Getscreen.me\",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\Downloads\getscreen-x86.exe",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,"C:\Users\*\Downloads\getscreen.upd.exe",,,RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,,,"Point B Ltd*",RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +GetScreen,,,,,"getscreen.me*",RMM,"https://docs.getscreen.me/self-hosted/system-requirements/,https://sagalabs.dk/blog/getscreen-yet-another-rmm","GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named ""Getscreen.me""." +"Go Mini RMM","Go Mini RMM*",,,,,RMM,"https://github.com/cevrimxe/go-mini-rmm,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/README.md,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.ps1,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.sh,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/agent/executor/executor.go,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/server/api/router.go","Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product." +"Go Mini RMM","GoMiniRMM*",,,,,RMM,"https://github.com/cevrimxe/go-mini-rmm,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/README.md,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.ps1,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/web/templates/install.sh,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/agent/executor/executor.go,https://github.com/cevrimxe/go-mini-rmm/blob/9b24b1749b5dac0a14bee4ce026181cec0843a08/internal/server/api/router.go","Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product." +"GoTo Opener","GoTo Opener*",,,,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener","GoToOpener*",,,,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener",,,"*\GoTo Opener",,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoTo Opener",,,"C:\Program Files (x86)\GoTo Opener",,,RMM,"","GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,"GoToAssist*",,,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.cdn.getgo.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.desktopstreaming.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.fastsupport.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.getgo.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.at",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"*.gotoassist.me",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"goto.com",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,"helpme.net",,,,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"GoTo Assist Opener.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2a*.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2ax_comm_customer.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2mcomm.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"g2mupdate.com",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"goto opener.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,"gotoassist.exe",,RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToAssist,,,,,"GoToAssist*",RMM,"https://help.gotoassist.com/remote-support/help/what-should-i-allow-on-my-firewall-for-gotoassist-remote-support-v5","GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist (GoTo Resolve)","GoTo Resolve*",,,,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)","GoToAssist*",,,,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,"C:\Program Files (x86)\GoTo Resolve Unattended\*",,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,"C:\Program Files\GoTo Resolve Unattended\*",,,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveExternalModuleHandler.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveFileManager.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveLoggerProcess.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveNetworkChecker.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveProcessChecker.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveQuickView.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveRegistryEditor.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveRemoteControl.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveService.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveServiceManager.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTerminal.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTools32.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveTools64.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUi.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattended.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattendedRemover.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,"GoToResolveUnattendedUi.exe",,RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist (GoTo Resolve)",,,,,"GoToAssist*",RMM,"https://asec.ahnlab.com/en/90968/","GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform." +"GoToAssist Agent Desktop Console","GoToAssist Agent Desktop Console*",,,,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console","GoToAssistAgentDesktopConsole*",,,,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console",,,"*\G2RDesktopConsole-x64.msi",,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GoToAssist Agent Desktop Console",,,"C:\*\G2RDesktopConsole-x64.msi",,,RMM,"","GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,"GoToMyPC*",,,,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,"*.GoToMyPC.com",,,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,"%APPDATA%\GoToMeeting\G2M.exe",,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,"C:\Program Files (x86)\GoToMyPC\*",,,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,"G2M.exe",,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,,GoToOpener,RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GoToMyPC,,,,,"GoTo Opener",RMM,"https://support.logmeininc.com/gotomypc/help/what-are-the-optimal-firewall-configurations#,https://support.goto.com/training/help/how-do-i-configure-gototraining-to-work-with-firewalls,https://ruler-project.github.io/ruler-project/RULER/remote/Citrix%20GoToMyPC/,https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader,https://www.virustotal.com/gui/file/0d3ca4872e757fa406c10aa6893e831c2aaadce0687537d14fdce1702517b2d0/behavior","GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Gorelo RMM","Gorelo RMM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM","GoreloRMM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"app.gorelo.io",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"gorelo-rmm.azurewebsites.net",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"gw.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"lr.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"public.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"r1.rmm.uw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +"Gorelo RMM",,"sr.rmm.pod1.usw.gorelo.tech",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/117,https://www.linkedin.com/posts/magicswordio_new-to-lolrmmio-gorelormm-gorelormm-activity-7394482892422393856-BtKl/,https://app.any.run/tasks/8b12557e-8c76-41e8-a3c7-e491f32a0b11","Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration." +GotoHTTP,"GotoHTTP*",,,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,"*.gotohttp.com",,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,"gotohttp.com",,,,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"GotoHTTP*.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"GotoHTTP_x64.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,"gotohttp.exe",,RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,,"Pingbo*",RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +GotoHTTP,,,,,"GotoHTTP*",RMM,"https://gotohttp.com/goto/help.12x","GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,"Goverlan*",,,,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,"goverlan.com",,,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"*\GovSrv.exe",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"*\PJ Technologies\GOVsrv\*",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,"C:\Program Files (x86)\PJ Technologies\GOVsrv\*",,,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovAgentInstallHelper.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovAgentx64.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"GovReachClient.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"goverrmc.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,"govsrv*.exe",,RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Goverlan,,,,,"Goverlan*",RMM,"https://www.goverlan.com/pdf/Goverlan-Remote-Control-Software.pdf","Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,"Guacamole*",,,,,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,,"guacamole.apache.org",,,,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Guacamole,,,,"guacd.exe",,RAT,"https://guacamole.apache.org","Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"GxM RMM Agent","GxM RMM Agent*",,,,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent","GxMRMMAgent*",,,,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\agent\GxM.Agent.exe",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\enrollment.json",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"*\ProgramData\GxM\install.log",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +"GxM RMM Agent",,,"C:\GxM\agent",,,RMM,"","GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign." +HeartbeatRM,"HeartbeatRM*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,"*.heartbeatrm.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,"heartbeatrm.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"*\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"C:\Program Files (x86)\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,"C:\Program Files\HeartbeatRM\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"agent-installer-any.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"hbrm-updater-x64.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HeartbeatRM,,,,"hbrm-x64.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/136,https://heartbeatrm.com/","HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation." +HelpBeam,"HelpBeam*",,,,,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpBeam,,"helpbeam.software.informer.com",,,,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpBeam,,,,"helpbeam*.exe",,RMM,"https://www.helpbeam.com domain for sale in 2024","HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,"HelpU*",,,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,"*.helpu.co.kr",,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,"helpu.co.kr",,,,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"HelpuManager.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"HelpuUpdater.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,"helpu_install.exe",,RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,,"Help Manager Program",RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpU,,,,,"helpU*",RMM,"https://helpu.co.kr/","HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +HelpWire,"HelpWire*",,,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"account.flexihub.com",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"api.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"get.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"staging.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"stun.helpwire.app",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,"stunserver.stunprotocol.org",,,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"/Applications/HelpWire Operator.app",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"/lib/systemd/system/helpwire-unattended.service",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,"helpwire-operator/bin/helpwire-operator",,,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire Quick.exe",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire Unattended Access.lnk",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"HelpWire.lnk",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HelpWire,,,,"helpwire.exe",,RMM,"https://www.helpwire.app/,https://www.helpwire.app/download/windows/,https://www.helpwire.app/download/windows/thank-you/,https://www.helpwire.app/download/macos/thank-you/,https://www.helpwire.app/download/linux/thank-you/,https://www.helpwire.app/unattended-remote-access/,https://kb.helpwire.app/operator-application/installation/,https://kb.helpwire.app/unattended/request-unattended-access/,https://kb.helpwire.app/unattended/connect/","HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates." +HopToDesk,"HopToDesk*",,,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"api.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"download.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"signal.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"turn.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,"www.hoptodesk.com",,,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,"C:\Program Files (x86)\HopToDesk\HopToDesk.exe",,,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,,"HopToDesk-Standalone.exe",,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +HopToDesk,,,,"HopToDesk.exe",,RMM,"https://www.hoptodesk.com/#faqlink,https://gitlab.com/hoptodesk/hoptodesk,https://github.com/magicsword-io/LOLRMM/issues/92,https://www.hoptodesk.com/,https://www.virustotal.com/gui/file/ebd2c015cc43e0fedf0122768d65e3256d78c57422111a3ad21efe7663507ee5/details,https://gitlab.com/hoptodesk/hoptodesk/","HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity." +"I'm InTouch","I'm InTouch*",,,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch","I'mInTouch*",,,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,"*.01com.com",,,,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"I'm InTouch Go Installer.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"iit.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,"intouch.exe",,RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"I'm InTouch",,,,,"I'm InTouch*",RMM,"https://www.01com.com/mobile/imintouch-remote-pc-desktop/faqs/remote-access/","I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light","ISL Light*",,,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light","ISLLight*",,,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,"islonline.com",,,,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"islalwaysonmonitor.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"isllight.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Light",,,,"isllightservice.exe",,RMM,"","ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online","ISL Online*",,,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online","ISLOnline*",,,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,"*.islonline.com",,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,"*.islonline.net",,,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"*\ISL Online\ISL Light*",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"*\ISLLight.exe",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,"C:\Program Files (x86)\ISL Online\ISL Light*",,,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"ISLLight.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"ISLLightClient.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"islalwaysonmonitor.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"isllight.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,"isllightservice.exe",,RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,,"ISL Light*",RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ISL Online",,,,,"ISL Online*",RMM,"https://help.islonline.com/19818/165940","ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IT Agent","IT Agent*",,,,,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent","ITAgent*",,,,,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSender.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSenderSL.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentRMMSenderUpdater.exe",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"IT Agent",,,,"ITAgentSender.aiui",,RMM,"https://www.itagent.com/it-agent-remote-access,https://www.itagent.com/remote-desktop-access,https://www.duetdisplay.com/remote-desktop-access-software","IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry." +"ITSupport247 (ConnectWise)","ConnectWise*",,,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)","ITSupport247*",,,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,"*.itsupport247.net",,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,"itsupport247.net",,,,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ITSupport247 (ConnectWise)",,,,"saazapsc.exe",,RMM,"https://control.itsupport247.net/","ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ImmyBot,"ImmyBot*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,"*.immy.bot",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,"immy.bot",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"*\ImmyBot\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files (x86)\ImmyBot\ImmyAgent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files (x86)\ImmyBot\ImmyUpdater.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files\ImmyBot\ImmyAgent.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Program Files\ImmyBot\ImmyUpdater.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,"C:\Windows\Temp\ImmyBot\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyAgent.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyBot.Agent.Ephemeral.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyBot.msi",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +ImmyBot,,,,"ImmyUpdater.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/135,https://www.immy.bot/,https://docs.immy.bot/Documentation/HowToGuides/agent-installation,https://docs.immy.bot/Documentation/Troubleshooting/security-software.html,https://docs.immy.bot/troubleshooting","ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints." +"Impero Connect","Impero Connect*",,,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect","ImperoConnect*",,,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect",,"imperosoftware.com",,,,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Impero Connect",,,,"ImperoClientSVC.exe",,RMM,"","Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall","Instant Housecall*",,,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall","InstantHousecall*",,,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"*.instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"*.instanthousecall.net",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,"secure.instanthousecall.com",,,,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"InstantHousecall.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"hsloader.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"ihcserver.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Instant Housecall",,,,"instanthousecall.exe",,RMM,"https://instanthousecall.com/features/","Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,"Insync*",,,,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"*Users\*\AppData\Roaming\Insync\App\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"*\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Insync,,,"C:\Users\USERNAME\AppData\Roaming\Insync\App\Insync.exe",,,RAT,"","Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control","IntelliAdmin Remote Control*",,,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control","IntelliAdminRemoteControl*",,,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,"*.intelliadmin.com",,,,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent32.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent64.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"agent_setup_5.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"iadmin.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"IntelliAdmin Remote Control",,,,"intelliadmin.exe",,RMM,"http://www.intelliadmin.com/index.php/remote-control/","IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +InvGate,"InvGate*",,,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"*.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"docs.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"help.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"instances-info.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"instances-list.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"lb-insight-001.invgate.net",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"releases.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"trust-access.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"trust.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,"www.invgate.com",,,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\*",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\DepHlp.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\InvGate-ED.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\Software Matt.dll",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\InvGateAssetsRD.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\InvGateRD.exe",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +InvGate,,,"C:\Program Files (x86)\Inventec\InvGate.net Client\files\sas.dll",,,RMM,"https://invgate.com/,https://invgate.com/asset-management,https://invgate.com/asset-management/remote-management,https://invgate.com/asset-management/software-deployment,https://invgate.com/asset-management/product-tour/remote-it-support,https://invgate.com/itdb/invgate-asset-management,https://invgate.com/service-management,https://blog.invgate.com/invgate-asset-management-agent,https://blog.invgate.com/launching-software-deployment-capabilities-on-invgate-asset-management,https://blog.invgate.com/agentless-discovery-for-windows-devices-on-invgate-asset-management,https://blog.invgate.com/introducing-invgate-service-and-asset-management,https://blog.invgate.com/whats-new-with-invgate-march-2024,https://releases.invgate.com/service-desk/api/,https://play.google.com/store/apps/details?id=com.invgate.insight.agent,https://www.advanceduninstaller.com/InvGate-Assets-Client-2f4c0513ea2872f134927af517dacc3c-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-196dfb9b5b25fa914ceffa42ee216d05-application.htm,https://www.advanceduninstaller.com/InvGate-Assets-Client-d803c0bfcc9fdf1f0811a1a8e8e3ff3d-application.htm,https://www.shouldiremoveit.com/InvGate-Assets-Client-35975-program.aspx,https://www.virustotal.com/gui/file/d35d852924b97126cfbf9a2d8c3384d848dbb090a9d9264e26dd766370b474e8","InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click ""remote desktop connection from your inventory"" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the ""Inventec"" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console." +"Iperius Remote","Iperius Remote*",,,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote","IperiusRemote*",,,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperius-rs.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperius.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"*.iperiusremote.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,"iperiusremote.com",,,,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,"iperius.exe",,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,"iperiusremote.exe",,RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Enter S.R.L*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Iperius Remote*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Iperius Remote",,,,,"Enter Srl*",RMM,"https://www.iperiusremote.com/download-iperius-remote-desktop-windows.aspx","Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,"Itarian*",,,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"*.cmdm.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"*.itsm-us1.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"mdmsupport.comodo.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"remoteaccess.itarian.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,"servicedesk.itarian.com",,,,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ComodoRemoteControl.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITSMAgent.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITSMService.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ITarianRemoteAccessSetup.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"ItsmRsp.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RAccess.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RDesktop.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RHost.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RViewer.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,"RmmService.exe",,RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,,"RMM*",RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Itarian,,,,,"Itarian*",RMM,"https://help.itarian.com/topic-459-1-1005-14776-Appendix-1b---Endpoint-Manager-Services---IP-Nos,-Host-Names-and-Port-Details---US-Customers.html","Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control","Ivanti Remote Control*",,,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control","IvantiRemoteControl*",,,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,"*.ivanticloud.com",,,,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"AgentlessRC.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"ArcUI.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Ivanti Remote Control",,,,"IvantiRemoteControl.exe",,RMM,"https://rc1.ivanticloud.com/","Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +JollysFastVNC,"JollysFastVNC*",,,,,RAT,"","JollysFastVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud","Jump Cloud*",,,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud","JumpCloud*",,,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,"*.api.jumpcloud.com",,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,"*.assist.jumpcloud.com",,,,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,,,"JumpCloud*.exe",,RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Cloud",,,,,"JumpCloud*",RMM,"https://jumpcloud.com/support/understand-remote-assist-agent","Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop","Jump Desktop*",,,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop","JumpDesktop*",,,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"*.jumpdesktop.com",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"*.jumpto.me",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"jumpdesktop.com",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,"jumpto.me",,,,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpclient.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpconnect.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpdesktop.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpservice.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Jump Desktop",,,,"jumpupdater.exe",,RMM,"https://support.jumpdesktop.com/hc/en-us/articles/360042490351-Administrators-Guide-For-Jump-Desktop-Connect","Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,"KHelpDesk*",,,,,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,"*.khelpdesk.com.br",,,,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,"KHelpDesk.exe",,RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,,"Ferramenta de Acesso Remoto",RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KHelpDesk,,,,,"KHELPDESK*",RMM,"https://www.khelpdesk.com.br/en-us","KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,"Kabuto*",,,,,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,,"*.kabuto.io",,,,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Kabuto,,,,"Kabuto.App.Runner.exe",,RMM,"https://www.repairtechsolutions.com/documentation/kabuto/","Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,"KiTTY*",,,,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,,,"*\kitty.exe",,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KiTTY,,,"C:\*\kitty.exe",,,RAT,"","KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,"KickIdler*",,,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,"kickidler.com",,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,"my.kickidler.com",,,,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,,,"grabberEM.*msi",,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +KickIdler,,,,"grabberTT*.msi",,RMM,"https://www.kickidler.com/for-it/faq/","KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Komari,"Komari*",,,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"ghcr.io",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"github.com",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"komari-document.pages.dev",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"raw.githubusercontent.com",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,"www.komari.wiki",,,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/etc/systemd/system/komari-agent.service",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/etc/systemd/system/komari.service",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/opt/komari/*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"/usr/local/komari/*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"C:\Program Files\Komari\*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Komari,,,"C:\komari\*",,,RMM,"https://www.huntress.com/blog/komari-c2-agent-abuse,https://github.com/komari-monitor/komari,https://github.com/komari-monitor/komari-agent,https://raw.githubusercontent.com/komari-monitor/komari/main/install-komari.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.sh,https://raw.githubusercontent.com/komari-monitor/komari-agent/main/install.ps1","Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent." +Koofr,"Koofr*",,,,,RAT,"","Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Koofr,,,,,"koofr*",RAT,"","Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,"LANDesk*",,,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"*.ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"*.ivanticloud.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,"ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\LANDesk\*",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\issuser.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\softmon.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"*\tmcsvc.exe",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,"C:\Program Files (x86)\LANDesk\*",,,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"LANDeskPortalManager.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"issuser.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"landeskagentbootstrap.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"ldinv32.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LANDesk,,,,"ldsensors.exe",,RMM,"https://forums.ivanti.com/s/article/URL-exception-list-for-Ivanti-Security-Controls?language=en_US","LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LS RMM","LS RMM*",,,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM","LSRMM*",,,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,"webserv.logistical-software.co.uk",,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,"www.logistical-software.co.uk",,,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,"C:\Program Files (x86)\LS RMM\LS RMM Worker.exe",,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,"C:\Program Files (x86)\LS RMM\LS RMM.exe",,,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,,"LS RMM Worker.exe",,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LS RMM",,,,"LS RMM.exe",,RMM,"","LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use." +"LabTeach (Connectwise Automate)","Connectwise Automate*",,,,,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTeach (Connectwise Automate)","LabTeach*",,,,,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTeach (Connectwise Automate)",,,,"ltsvc.exe",,RMM,"","LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","ConnectWise Automate*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTech RMM*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTech*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)","LabTechRMM*",,,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,"connectwise.com",,,,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"ltsvc.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"ltsvcmon.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LabTech RMM (ConnectWise Automate)",,,,"lttray.exe",,RMM,"","LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere","Laplink Everywhere*",,,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere","LaplinkEverywhere*",,,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"atled.syspectr.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"everywhere.laplink.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,"le.laplink.com",,,,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"OOSysAgent.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplink-everywhere-setup*.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplink.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"laplinkeverywhere.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"llrcservice.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Everywhere",,,,"serverproxyservice.exe",,RMM,"https://everywhere.laplink.com/docs","Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold","Laplink Gold*",,,,,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold","LaplinkGold*",,,,,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold",,,,"laplink.exe",,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Laplink Gold",,,,"tsircusr.exe",,RMM,"https://web.laplink.com/product/laplink-gold","Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Lavawall,"Lavawall*",,,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"api-ca-1.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"caremote1.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,"lavawinupdate.lavawall.com",,,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Program Files (x86)\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Lavawall,,,"C:\Program Files\Lavawall\LavawallWin.exe",,,RMM,"https://lavawall.com/rmm/,https://www.lavawall.com/remote-support/,https://www.lavawall.com/faq/,https://console.lavawall.com/FAQ.php,https://lavawinupdate.lavawall.com/version.json,https://lavawinupdate.lavawall.com/remote-agent.zip,https://www.virustotal.com/gui/file/1e395934cbef22846dd0dd2daf868429b0a5b86313f9721543b03a66cfc25e77,https://www.virustotal.com/gui/file/a3b3eec0fbd1108c3cb476f5495f77dcd19b4d40d23e8240c0e983acc401bce0,https://www.virustotal.com/gui/file/efd86ad34b94514d5416f40bc3de42c2c7a174f82a9a5ce70c1806f062ce4de7","Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools." +Level,"Level*",,,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"agents.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"builds.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"downloads.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,"online.level.io",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +Level,,,"C:\Program Files\Level\*",,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://dfirtnt.wordpress.com/2023/09/05/rmm-level-io-forensic-artifacts-and-evidence/,https://docs.level.io/en/articles/9926456-level-watchdog-task","Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity." +"Level.io","Level.io*",,,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,"*.level.io",,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,"level.io",,,,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level-remote-control-ffmpeg.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level-windows-amd64.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,"level.exe",,RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Level.io",,,,,"Level*",RMM,"https://docs.level.io/1.0/admin-guides/troubleshooting-agent-issues","Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LightRmmAgent,"LightRmmAgent*",,,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +LightRmmAgent,,"light-rmm-monitor-20260825.azurewebsites.net",,,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +LightRmmAgent,,,"C:\Program Files\LightRmmAgent\*",,,RMM,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike","LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established." +"Lite Manager","Lite Manager*",,,,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager","LiteManager*",,,,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"*\LMNoIpServer.exe",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"*\LiteManager Pro – Viewer\*",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,"C:\Program Files\LiteManager Pro – Viewer\*",,,RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"LiteManager*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"ROMServer*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"ROMViewer*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Lite Manager",,,,,"Yakhnovets Denis*",RMM,"","Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,"LiteManager*",,,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"*.litemanager.com",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"*.litemanager.ru",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,"litemanager.com",,,,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"ROMFUSClient.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"ROMServer.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"lmnoipserver.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romfusclient.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romserver.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,"romviewer.exe",,RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"LiteManager*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"ROMServer*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"ROMViewer*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LiteManager,,,,,"Yakhnovets Denis*",RMM,"https://www.litemanager.com/articles/LiteManager_remote_access_to_a_desktop_via_the_Internet_or_LAN/","LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LocalXpose,"LocalXpose*",,,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"*.localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"api.localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,"localxpose.io",,,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"%APPDATA%\loclx\*",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"*\loclx.exe",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"/usr/local/bin/loclx",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,"C:\Users\*\AppData\Local\Programs\loclx\loclx.exe",,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,,loclx,,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LocalXpose,,,,"loclx.exe",,RAT,"https://localxpose.io/,https://lottunnels.github.io/lottunnels/Binaries/localxpose/","LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the ""shell access"" category because the `loclx tunnel tcp/udp --port ` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure." +LogMeIn,"LogMeIn*",,,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmein.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmein.eu",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"*.logmeininc.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"logmein-gateway.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,"logmeinrescue.com",,,,RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,,,,"RemotelyAnywhere*",RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +LogMeIn,,,,,"LogMeIn*",RMM,"https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration","LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue","LogMeIn rescue*",,,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue","LogMeInrescue*",,,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"*.logmeinrescue.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"*.logmeinrescue.eu",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"logmeinrescue.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"rescue-data-cetner.logmein-gateway.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,"rescue-list.*.logmein-gateway.com",,,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,"C:\Users\*\AppData\Local\LogMeIn Rescue Applet\LMIR*.tmp\lmi_rescue.exe",,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,"C:\Users\*\AppData\Local\LogMeIn Rescue Applet\LMIR*.tmp\lmi_rescue_srv.exe",,,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"lmi_rescue.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"support-logmeinrescue*.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"LogMeIn rescue",,,,"support-logmeinrescue.exe",,RMM,"https://support.logmeinrescue.com/rescue/help/allowlisting-and-rescue","LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Lunixar,"Lunixar*",,,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"*.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"app.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"devrmm.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"downloads.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"mymeetinggoogle.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,"socket.lunixar.com",,,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.Agent.Core.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\Lunixar.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarRemote.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarRemote.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarUpdater.dll",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"*\Lunixar\LunixarUpdater.exe",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,"C:\Program Files\Lunixar\*",,,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"Googlemeet.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"LunixarRMM*.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +Lunixar,,,,"eDocument-*.msi",,RMM,"https://lunixar.com/en/,https://lunixar.com/en/rmm-abuse-prevention/,https://lunixar.com/en/blog/lunixar-blocks-renaming-agent-installers-to-prevent-abuse/,https://www.virustotal.com/gui/file/3160414da55882b9f03bae5aa76f0dc3c6cdb9e27e9091d9dac6fa610bd94c33","Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts." +MEGAsync,"MEGAsync*",,,,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*ProgramData\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*Users\*\AppData\Local\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*\MEGAsyncSetup64.exe",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"*\MEGAupdater.exe",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,"C:\Users\*\AppData\Local\MEGAsync\*",,,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,,,MEGAsync,RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MEGAsync,,,,,"MEGA Limited",RAT,"","MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,"MSP360*",,,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.cloudberrylab.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.msp360.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"*.mspbackups.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,"msp360.com",,,,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CBBackupPlan.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Cloud.Backup.RM.Service.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Cloud.Backup.Scheduler.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaCmd.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaSd.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaService.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"CloudRaUtilities.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Connect.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Online Backup.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"RMM.Agent.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"Remote Desktop.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,"cbb.exe",,RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,,"Cloud.Ra*",RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MSP360,,,,,"MSP360*",RMM,"https://kb.msp360.com/managed-backup-service/mbs-tcp-ports-configuration#","MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","Desktop Central*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","Manage Engine*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)","ManageEngine*",,,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.-dms.zoho.com.cn",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.dms.zoho.com",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"*.dms.zoho.com.eu",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.cn",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.com",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,"desktopcentral.manageengine.com.eu",,,,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,,,"dcagentregister.exe",,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Manage Engine (Desktop Central)",,,,"dcagentservice.exe",,RMM,"","Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine RMM Central","ManageEngine RMM Central*",,,,,RMM,"","ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine RMM Central","ManageEngineRMMCentral*",,,,,RMM,"","ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"ManageEngine ServiceDesk Plus","ManageEngine ServiceDesk Plus*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus","ManageEngineServiceDeskPlus*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,"*.manageengine.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,"manageengine.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,"C:\Program Files (x86)\ManageEngine\ServiceDesk\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,"C:\Program Files\ManageEngine\ServiceDesk\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,,"ManageEngine_ServiceDesk_Plus.bin",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +"ManageEngine ServiceDesk Plus",,,,"ManageEngine_ServiceDesk_Plus.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/50,https://www.manageengine.com/products/service-desk/download.html,https://www.virustotal.com/gui/file/177bfdbe81bb4756d1d324ddf1bff4350252f0efd8a7f5c8b60a3a8e882affbd/details","ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support." +MeshCentral,"MeshCentral*",,,,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,"meshcentral.com",,,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,"/usr/local/mesh_services/meshagent/*",,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,"/usr/local/mesh_services/meshagent/meshagent/*",,,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,"meshagent*.exe",,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,"meshcentral*.exe",,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +MeshCentral,,,,,meshcentral,RMM,"https://ylianst.github.io/MeshCentral/meshcentral/,https://github.com/Ylianst/MeshAgent","MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes." +"Microsoft Quick Assist","Microsoft Quick Assist*",,,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist","MicrosoftQuickAssist*",,,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,"*.support.services.microsoft.com",,,,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,,,"quickassist.exe",,RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Microsoft Quick Assist",,,,,"Quick Assist",RAT,"https://support.microsoft.com/en-us/windows/install-quick-assist-c17479b7-a49d-4d12-938c-dbfb97c88bca","Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,"Mikogo*",,,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.mikogo.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.mikogo4.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"*.real-time-collaboration.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,"mikogo.com",,,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*Users\*\AppData\Roaming\Mikogo\*",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*\Mikogo-Screen-Service.exe",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"*\Mikogo-Service.exe",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,"C:\Users\*\AppData\Roaming\Mikogo\*",,,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo-service.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo-starter.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogo.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Mikogo,,,,"mikogolauncher.exe",,RMM,"https://mikogo.zendesk.com/hc/en-us/articles/214072478-Which-IP-addresses-do-we-use-for-our-services","Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Minexus,"Minexus*",,,,,RMM,"https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/README.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/documentation/configuration.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/internal/web/webroot/templates/install_minion.sh,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/cmd/minion/minion.go","Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review." +Minexus,,,"/etc/systemd/system/minion.service",,,RMM,"https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/README.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/documentation/configuration.md,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/internal/web/webroot/templates/install_minion.sh,https://github.com/arhuman/minexus/blob/fe9174c5f3807b1f56fb772d3725b10a34552f37/cmd/minion/minion.go","Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review." +"Mini RMM Agent","Mini RMM Agent*",,,,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent","MiniRMMAgent*",,,,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\Program Files\MiniRMM\MiniRmmAgent.exe",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\ProgramData\MiniRMM\Invoke-AVExclusions.ps1",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"Mini RMM Agent",,,"C:\ProgramData\MiniRMM\SmartScreenTest.ps1",,,RMM,"","Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse." +"MioNet (Also known as WD Anywhere Access)","Also known as WD Anywhere Access*",,,,,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)","MioNet*",,,,,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)",,,,"mionet.exe",,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (Also known as WD Anywhere Access)",,,,"mionetmanager.exe",,RMM,"","MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)","MioNet*",,,,,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)","WD Anywhere Access*",,,,,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)",,,,"mionet.exe",,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"MioNet (WD Anywhere Access)",,,,"mionetmanager.exe",,RMM,"https://en.wikipedia.org/wiki/WD_Anywhere_Access - DOA as of 2016","MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Miradore,"Miradore*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"*.miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"gateway.miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"gerwconline.blob.core.windows.net",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,"miradore.com",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,,"*\Miradore\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +Miradore,,,"C:\Program Files\Miradore\OnlineClient\bin\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/118,https://www.virustotal.com/gui/file/fedf9d82fb1349a5eecf0fad4a9d9eac7e160130e563b9bd3328b5f04891bbd6/details,https://app.any.run/tasks/5d088796-fb67-45bb-9ee0-369b502522fc,https://www.miradore.com/","Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access." +"Mocha VNC Lite","Mocha VNC Lite*",,,,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite","MochaVNCLite*",,,,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite",,,"*\RealVNC\VNC4\*",,,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Mocha VNC Lite",,,,"This installs a modified VNC and cannot be blocked by path separate from VNC",,RAT,"","Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Monitic,"Monitic*",,,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"api.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"app.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"devapi.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"turn.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,"www.monitic.com",,,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\*",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\agent.exe",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\amon.exe",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +Monitic,,,"C:\Program Files\Monitic\conf.json",,,RMM,"https://www.monitic.com/,https://www.monitic.com/en,https://www.monitic.com/en/why-monitic,https://www.monitic.com/faq,https://www.monitic.com/en/features/streamlined-remote-access,https://www.monitic.com/en/products/remote-access-and-control,https://app.monitic.com/,https://rules.emergingthreats.net/,https://www.virustotal.com/gui/file/d641841cdf83037b32e699f01da16b66a9064221013dfec43d7a3bc993d6181d,https://www.virustotal.com/gui/file/71cd67afd19f9f5d0cf00d92034c40b674e3b4d9888f5be6c2f401c52863a523,https://www.virustotal.com/gui/file/9c6b26fe30870775a42d02804c9094c83479850a87703d95ebd8631ad8188b8e,https://www.virustotal.com/gui/file/53cc6eb7f52e917e3d670337204e83c2dd68cb0e5c57384a1b3fe8d12d9a46bb,https://www.virustotal.com/gui/domain/monitic.com,https://www.virustotal.com/gui/domain/app.monitic.com,https://www.virustotal.com/gui/domain/api.monitic.com,https://www.virustotal.com/gui/domain/turn.monitic.com","Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed." +"Mouse Without Borders","Mouse Without Borders*",,,,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"Mouse Without Borders","MouseWithoutBorders*",,,,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +"Mouse Without Borders",,,"C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\*",,,RAT,"https://www.microsoft.com/en-us/download/details.aspx?id=35460,https://learn.microsoft.com/windows/powertoys/mouse-without-borders,https://github.com/microsoft/PowerToys/issues/29700","Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +MultCloud,"MultCloud*",,,,,RAT,"","MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MultCloud,,,,"requires sign up",,RAT,"","MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,"MyGreenPC*",,,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,"*.mygreenpc.com",,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,"mygreenpc.com",,,,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyGreenPC,,,,"mygreenpc.exe",,RMM,"http://www.mygreenpc.com/","MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,"MyIVO*",,,,,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,"myivo-server.software.informer.com",,,,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,,,"myivomanager.exe",,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +MyIVO,,,,"myivomgr.exe",,RMM,"https://myivo.com","MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-ABLE Remote Access Software*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-ABLERemoteAccessSoftware*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software","N-able*",,,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-ABLE Remote Access Software",,"n-able.com",,,,RMM,"","N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent","N-Able Advanced Monitoring Agent*",,,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent","N-AbleAdvancedMonitoringAgent*",,,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.beanywhere.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.cloudbackup.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.logicnow.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.n-able.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.remote.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.swi-tc.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.system-monitor.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.co.uk",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.eu.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"*.systemmonitor.us",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"beanywhere.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"cloudbackup.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"logicnow.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"n-able.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"remote.management",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"system-monitor.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.co.uk",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.eu.com",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.us",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,"systemmonitor.us.cdn.cloudflare.net",,,,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"Agent_*_RW.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASEClient.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupApp.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupSrvc.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupSrvcCnfg.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"BASupTSHelper.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,"winagent.exe",,RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,,"Remote Monitoring*",RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-Able Advanced Monitoring Agent",,,,,"N-Able*",RMM,"https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm","N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"N-able N-central","N-able N-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central","N-ableN-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central","N-central*",,,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"*.prd.cdo.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.ap-southeast-2.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.eu-central-1.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.eu-west-1.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"a33d8yamkwy4nx-ats.iot.us-west-2.amazonaws.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.eu1.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.global.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.us1.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"comserver.us2.mspa.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.ap-southeast-2.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.eu-central-1.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.eu-west-1.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"eb.us-west-2.prd.davinci.system-monitor.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"feeds.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"releases.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"sis.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"swi-rc.cdn-sw.net",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,"update.n-able.com",,,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"/Library/MspAgent/*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"/opt/msp-agent/*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\Msp Agent\*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\*",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,"C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe",,,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"AgentMaint.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"AgentMonitor.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"BASupTSHelper.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"N-able N-central",,,,"msp-agent-core.exe",,RMM,"https://documentation.n-able.com/N-central/userguide/Content/Modern-agent/modern-agent.htm,https://documentation.n-able.com/N-central/userguide/Content/ReleaseDocs/Install_Config/FirewallRequirements.htm,https://documentation.n-able.com/N-central/userguide/Content/AVDefender/AVDefender_GlobalExclusions.htm,https://documentation.n-able.com/N-central/userguide/Content/Deploying/agent_probe_services.htm,https://documentation.n-able.com/N-central/userguide/Content/User_Management/Selecting_device_credentials.htm,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_AddScriptTask.html,https://documentation.n-able.com/N-central/userguide/Content/Scheduled_Tasks/ScheduledTasks_Add3rdPartySoftwareTask.html,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_Command_Line_Mac.htm,https://documentation.n-able.com/N-central/userguide/Content/Devices/Direct%20Support/DS_File_Transfer_Mac.htm,https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/,https://www.cyber.gc.ca/en/alerts-advisories/n-able-security-advisory-av26-885","N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08." +"NTR Remote","NTR Remote*",,,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote","NTRRemote*",,,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,"*.ntrsupport.com",,,,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,,,"NTRsupportPro_EN.exe",,RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NTR Remote",,,,,"Net Transmit & Receive SL",RMM,"","NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NVDA (Non-Visual Desktop Access)","NVDA*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)","Non-Visual Desktop Access*",,,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,"*.nvaccess.org",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,"nvaccess.org",,,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Program Files (x86)\NVDA\nvda.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Program Files\NVDA\nvda.exe",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Users\*\AppData\Local\Temp\nvda_*\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,"C:\Users\*\AppData\Roaming\nvda\*",,,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda_*.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +"NVDA (Non-Visual Desktop Access)",,,,"nvda_service.exe",,RMM,"https://github.com/magicsword-io/LOLRMM/issues/89,https://www.nvaccess.org/,https://github.com/nvaccess/nvda/pull/17580","NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a ""Remote Access"" feature that enables remote support and assistance capabilities." +Naverisk,"Naverisk*",,,,,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,"naverisk.com",,,,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,"AgentSetup-*.exe",,RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,,"NavMK1 Limited*",RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Naverisk,,,,,"naverisk*",RMM,"http://kb.naverisk.com/en/articles/2811223-deploying-naverisk-agents","Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Net Monitor for Employees","Net Monitor for Employees*",,,,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees","NetMonitorforEmployees*",,,,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,"C:\Program Files (x86)\Net Monitor for Employees Pro\*",,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,"C:\Program Files\Net Monitor for Employees Pro\*",,,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_agtconfig.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_ctrlagent.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"nmep_ctrlagentsvc.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"winpty-agent.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +"Net Monitor for Employees",,,,"winpty-agent64.exe",,RMM,"https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://networklookout.com/","Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware." +NetBird,"NetBird*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"*.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"192.3.95.152",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"198.46.178.135",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"api.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"app.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"cloud-233f9.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"cloud-ed980.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-165a0.web.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-6c11f.firebaseapp.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"googl-6c11f.web.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"login.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my-sharepoint-inc.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my1cloudlive.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"my2cloudlive.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"pkgs.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"relay.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"signal.netbird.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,"web-16fe.app",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/Applications/NetBird UI.app",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/etc/netbird/install.conf",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/opt/netbird/*",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/usr/bin/netbird",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"/usr/local/bin/netbird",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\Program Files\Netbird\netbird-ui.exe",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\Program Files\Netbird\netbird.exe",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\ProgramData\Netbird\*",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\OpenSSH.msi",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\cis.vbs",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\netbird.msi",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\bin\trm.zip",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,"C:\temper\trm",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,netbird,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,"netbird-ui.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +NetBird,,,,"netbird.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/81,https://www.trellix.com/en-in/blogs/research/a-flyby-on-the-cfos-inbox-spear-phishing-campaign-targeting-financial-executives-with-netbird-deployment/,https://hunt.io/blog/apt-muddywater-deploys-multi-stage-phishing-to-target-cfos,https://netbird.io/knowledge-hub/netbird-response-to-spear-phishing-campaign-targeting-financial-executives,https://www.centripetal.ai/threat-research/threat-actors-abuse-netbird-in-spear-phishing-campaign-targeting-finance-executives,https://thehackernews.com/2025/06/fake-recruiter-emails-target-cfos-using.html,https://netbird.io/use-cases/remote-access,https://docs.netbird.io/how-to/installation,https://github.com/netbirdio/netbird,https://github.com/netbirdio/netbird/releases/latest","NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333)." +"NetLock RMM","NetLock RMM*",,,,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM","NetLockRMM*",,,,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/Library/Application Support/0x101_Cyber_Security/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/usr/0x101_Cyber_Security/Netlock_RMM/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/usr/local/bin/0x101_Cyber_Security/Netlock_RMM/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"/var/0x101_Cyber_Security/*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_Process.exe",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_UAC.exe",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,"C:\ProgramData\0x101 Cyber Security\NetLock RMM\Comm Agent\*",,,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,,"NetLock_RMM_Agent_Installer",,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +"NetLock RMM",,,,"NetLock_RMM_Agent_Installer.exe",,RMM,"https://www.netlockrmm.com,https://github.com/0x101-Cyber-Security/NetLock-RMM","NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering." +NetMaster,"NetMaster*",,,,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +NetMaster,,,"C:\ProgramData\NetMaster\NetMaster_Client.exe",,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +NetMaster,,,"C:\ProgramData\NetMaster\config.ini",,,RMM,"https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/README.md,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/ClientInstaller/installer.bat,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Core.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Command.cpp,https://github.com/f3di006/NetMaster/blob/b5dca5f2f11d8a76cda25122e82eb44cdcb07725/NetMaster_Client/Log.cpp","NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review." +"NetSupport Manager","NetSupport Manager*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager","NetSupport*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager","NetSupportManager*",,,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"*.netsupportmanager.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"geo.netsupportsoftware.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,"netsupportmanager.com",,,,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"client32.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"pcicfgui.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"pcictlui.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,"remcmdstub.exe",,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +"NetSupport Manager",,,,,netsupport,RMM,"https://www.netsupportmanager.com/resources/,https://www.netsupportmanager.com/complete-remote-control/,https://kb.netsupportsoftware.com/knowledge-base/netsupport-manager-control-command-line-options/,https://redcanary.com/threat-detection-report/threats/netsupport-manager/,https://www.cybereason.com/blog/net-support-rat-wordpress-clickfix,https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/","NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub." +Netop,"Netop*",,,,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"*\Danware Data\NetOp Packn Deploy\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"*\Netop Remote Control\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netop,,,"C:\Program Files\Danware Data\NetOp Packn Deploy\*",,,RMM,"","Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","Impero Connect*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","Netop Remote Control*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)","NetopRemoteControl*",,,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,"*.connect.backdrop.cloud",,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,"*.netop.com",,,,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"Connect.Backdrop.cloud*.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ImperoClientSVC.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ImperoInit.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"Netop Ondemand.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"ngstw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nhostsvc.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nhstw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"nldrw32.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,"rmserverconsolemediator.exe",,RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,,"Impero Connect*",RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (Impero Connect)",,,,,"Impero Solutions*",RMM,"https://kb.netop.com/article/firewall-and-proxy-server-considerations-when-using-netop-portal-communication-373.html","Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","Netop Remote Control*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","NetopRemoteControl*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)","aka Impero Connect*",,,,,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nhostsvc.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nhstw32.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"nldrw32.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,"rmserverconsolemediator.exe",,RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,,"Impero Connect*",RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netop Remote Control (aka Impero Connect)",,,,,"Impero Solutions*",RMM,"","Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,"Netreo*",,,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"*.api.netreo.com",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"activation.netreo.net",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"charon.netreo.net",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netreo,,"netreo.com",,,,RMM,"https://solutions.netreo.com/docs/firewall-requirements","Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,"Neturo*",,,,,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,"neturo.uplus.co.kr",,,,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"neturo*.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"neturo.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Neturo,,,,"ntrntservice.exe",,RMM,"http://www.iconpos.com/pos/home/iconpos/bbs.php?id=file&q=view&uid=2","Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,"Netviewer*",,,,,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,,,,"netviewer*.exe",,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Netviewer,,,,"netviewer.exe",,RMM,"","Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)","GoToMeet*",,,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)","Netviewer*",,,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,"*.netviewer.com",,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,"netviewer.com",,,,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"NetViewer.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"nvClient.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,"nvConsole.exe",,RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Netviewer (GoToMeet)",,,,,"Algorius*",RMM,"https://www.netviewer.com/de/support/download/","Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Nexus RMM (Scogo)","Nexus RMM*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)","NexusRMM*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)","Scogo*",,,,,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +"Nexus RMM (Scogo)",,,,"nexusrmm.exe",,RMM,"https://scogo.ai/,https://scogo.ai/blog/scogo-ai-is-now-available-on-microsoft-marketplace","Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution." +Nezha,"Nezha*",,,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"c.mid.al",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"gd.bj2.xyz",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"github.com",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"nezha.wiki",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"nezhahq.github.io",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"raw.githubusercontent.com",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,"rism.pages.dev",,,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"*\nezha-agent.exe",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/etc/systemd/system/nezha-agent.service",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/etc/systemd/system/nezha-dashboard.service",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/agent",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/agent/nezha-agent",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"/opt/nezha/dashboard",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"C:\Program Files\nezha\*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,"C:\nezha\*",,,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"dashboard-windows-amd64.exe",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha-agent",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha-agent.exe",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +Nezha,,,,"nezha_agent",,RMM,"https://github.com/nezhahq/nezha,https://nezha.wiki/,https://www.huntress.com/blog/nezha-china-nexus-threat-actor-tool,https://www.ontinue.com/resource/nezha-the-monitoring-tool-thats-also-a-perfect-rat/,https://github.com/ontinue-research/threat-intel-iocs/blob/main/Hunting/2025-12-18-HuntingRules-Nezha.md,https://www.infosecurity-magazine.com/news/nezha-abused-post-exploitation/,https://www.virustotal.com/gui/file/ebf4b09229a6ad720121a849c3a79af94e677a2e02448bb471b872d13d94fc93","Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published ""The Crown Prince, Nezha"" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup (""The Monitoring Tool That's Also a Perfect RAT"") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade." +"NinjaOne (formerly NinjaRMM)","NinjaOne*",,,,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NinjaOne (formerly NinjaRMM)","formerly NinjaRMM*",,,,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NinjaOne (formerly NinjaRMM)",,,"*ProgramData\NinjaRMMAgent\*",,,RMM,"","NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,"NinjaRMM*",,,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninja-backup.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjaone.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjarmm.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.ninjarmm.net",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.ca",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.com.au",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"*.rmmservice.eu",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninja-backup.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninjaone.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"ninjarmm.net",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"resources.ninjarmm.com",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.ca",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.com.au",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,"rmmservice.eu",,,,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"NinjaRMMAgent.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"NinjaRMMAgentPatcher.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,"ninjarmm-cli.exe",,RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,,"Ninja MSP*",RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NinjaRMM,,,,,"NinjaRMM*",RMM,"https://www.ninjaone.com/faq/","NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,"NoMachine*",,,,,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,"nomachine.com",,,,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nomachine*.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nxd.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,"nxservice*.exe",,RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NoMachine,,,,,"NoMachine*",RAT,"https://kb.nomachine.com/AR04S01122","NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,"NordLocker*",,,,,RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,NordLocker,RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,"NordSec Update Service",RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +NordLocker,,,,,"nordvpn*",RAT,"","NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing","NoteOn-desktop sharing*",,,,,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing","NoteOn-desktopsharing*",,,,,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateon*.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateon.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"NoteOn-desktop sharing",,,,"nateonmain.exe",,RAT,"","NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory","OCS inventory*",,,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory","OCSinventory*",,,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,"ocsinventory-ng.org",,,,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,"ocsinventory.exe",,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,"ocsservice.exe",,RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,,"OcsPackager*",RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"OCS inventory",,,,,"Ocs Inventory*",RMM,"https://ocsinventory-ng.org/?page_id=878&lang=en","OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Obliance,"Obliance*",,,,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/Library/LaunchDaemons/com.obliance.agent.plist",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/obliance-agent/config.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/systemd/system/obliance-agent.service",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/etc/systemd/system/obliance-watchdog.service",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/opt/obliance-agent/obliance-agent",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/usr/local/bin/obliance-agent",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"/var/log/obliance-agent.log",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-agent.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-tray.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\Program Files\OblianceAgent\obliance-watchdog.exe",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\agent.log",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\config.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Obliance,,,"C:\ProgramData\OblianceAgent\watchdog.json",,,RMM,"https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/README.md,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/product.wxs,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/registry_windows.go,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/installer/install.sh,https://github.com/MeeJay/Obliance/blob/f1eb7e886df9b16d46f13d19cec4b7d6cedcf4ac/agent/service_darwin.go","Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use." +Onionshare,"Onionshare*",,,,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"*\OnionShare\*",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"*\onionshare*.exe",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,"C:\Program Files (x86)\OnionShare\*",,,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Onionshare,,,,"OnionShare-win*.msi",,RAT,"","Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Opale,"Opale*",,,,,RMM,"https://github.com/4rtefakt/opale,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/README.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/INSTALL.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/branding/branding.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/config.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/install.ps1","Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform." +Opale,,,"C:\ProgramData\Opale\opale-agent.exe",,,RMM,"https://github.com/4rtefakt/opale,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/README.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/INSTALL.md,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/branding/branding.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/config.go,https://github.com/4rtefakt/opale/blob/4bf1b7ad9dd810fa97e2d1c6dd09aeaca42ba692/agent-go/install.ps1","Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform." +"OpenDesk RMM Agent","OpenDesk RMM Agent*",,,,,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent","OpenDeskRMMAgent*",,,,,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent",,,,"OpenDesk-RMM-Agent.exe",,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +"OpenDesk RMM Agent",,,,"opendesk-rmm-agent.exe",,RMM,"https://github.com/nextcoreti/opendesk-rmm-agent,https://github.com/nextcoreti/opendesk-rmm-agent/releases/tag/v2.10.24,https://github.com/nextcoreti/opendesk-rmm-agent/releases/download/v2.10.24/OpenDesk-RMM-Agent.exe","OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary." +OpenUEM,"OpenUEM*",,,,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/Library/OpenUEMAgent/etc/openuem-agent/openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/etc/openuem-agent/openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"/var/log/openuem-agent/openuem-agent.log",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\*",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\config\openuem.ini",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +OpenUEM,,,"C:\Program Files\OpenUEM Agent\logs\openuem-log.txt",,,RMM,"https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/README.md,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/service/windows/main.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_windows.go,https://github.com/open-uem/openuem-agent/blob/ee23c21f11464b9c130445d017b413385b6d0d9c/internal/logger/logger_linux.go,https://github.com/open-uem/openuem-console/blob/5604db7e4b4ac0fef5f95aad0ef279722966bd9d/README.md,https://openuem.eu/docs/Installation/Agent/windows/,https://openuem.eu/docs/Installation/Agent/linux/,https://openuem.eu/docs/Installation/Agent/macos/","OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use." +"OpsBridge Agent","OpsBridge Agent*",,,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent","OpsBridgeAgent*",,,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,"opsbridge.digital",,,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\Program Files\OpsBridge\OpsBridgeAgent.exe",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\ProgramData\OpsBridge\*",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +"OpsBridge Agent",,,"C:\Windows\System32\Tasks\OpsBridge Agent",,,RMM,"https://opsbridge.digital/,https://github.com/magicsword-io/LOLRMM/issues/242,https://www.virustotal.com/gui/file/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/behavior,https://www.virustotal.com/gui/file/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0,https://bazaar.abuse.ch/sample/6f5c207de0e60fb54e34f439b21c8c317539c8c0262f76ad1c19cff0ecb76914/,https://bazaar.abuse.ch/sample/2a0e94343f24039319e01636d1b30a368f43b598cff6d555fd14fa0f38236fb0/","OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name." +OptiTune,"OptiTune*",,,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,"*.opti-tune.com",,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,"*.optitune.us",,,,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,"OTPowerShell.exe",,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,"OTService.exe",,RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,,"OptiTune*",RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +OptiTune,,,,,"Bravura Software*",RMM,"https://www.bravurasoftware.com/optitune/support/faq.aspx","OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Overlord,"Overlord*",,,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok-free.app",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.app",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.com",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"*.ngrok.io",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"pandoramods.top",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,"savaliyapriyal874-code.github.io",,,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\agent-*.tmp",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\ovd_*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\DeviceSync\svchost.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-*.tmp",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ovd_*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\AppData\Roaming\Overlord\agent.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\agent-windows-amd64-*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,"*\svchost-windows-amd64-*.exe",,,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +Overlord,,,,"ovd_*.exe",,RAT,"https://any.run/malware-trends/overlord/,https://x.com/anyrun_app/status/2107063549172367583,https://app.any.run/tasks/9304f809-0265-4d7d-81f9-92f5835ba7c8/,https://github.com/doesntbreaktos/Overlord,https://lolrmm.io/tools/ngrok,https://lottunnels.github.io/lottunnels/Binaries/ngrok/","Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS." +PChelpware,"PChelpware*",,,,,RMM,"https://uvnc.com/downloads/pchelpware/","PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations." +PChelpware,,,"*\PcHelpWare_viewer.exe",,,RMM,"https://uvnc.com/downloads/pchelpware/","PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations." +"PDQ Connect","PDQ Connect*",,,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect","PDQConnect*",,,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"app.pdq.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"cfcdn.pdq.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,"pdqinstallers.*.r2.cloudflarestorage.com",,,,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,"PDQConnectUpdater-*.msi",,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,"pdq-connect*.exe",,RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,,"PDQConnectAgent*",RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"PDQ Connect",,,,,"PDQ.com*",RMM,"https://connect.pdq.com/hc/en-us/articles/12489014928667-Collect-PDQ-Connect-Event-Logs,https://connect.pdq.com/hc/en-us/articles/19197321496219-PDQ-Connect-Output-Logs,https://connect.pdq.com/hc/en-us/articles/9518992071707-Network-Requirements","PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","Pandora RC*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","PandoraRC*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)","eHorus*",,,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,"portal.ehorus.com",,,,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,"ehorus standalone.exe",,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,"ehorus_agent.exe",,RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pandora RC (eHorus)",,,,,"eHorus*",RMM,"https://pandorafms.com/manual/!current/en/documentation/09_pandora_rc/01_pandora_rc_introduction","Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,"Panorama9*",,,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"changes.panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,"trusted.panorama9.com",,,,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,,,"p9agent*.exe",,RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Panorama9,,,,,"Panorama9*",RMM,"https://support.panorama9.com/en/articles/1859605-what-ports-and-hosts-does-the-p9-agent-communicate-with","Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Parsec,"Parsec*",,,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"*.parsec.app",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"parsec.app",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,"parsec.gg",,,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,"C:\Program Files\Parsec\*",,,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,,"parsecd.exe",,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Parsec,,,,"pservice.exe",,RAT,"https://parsec.app/,https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior,https://x.com/malmoeb/status/1923255362318196951","Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access." +Pcnow,"Pcnow*",,,,,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"mwcliun.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"pcnmgr.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcnow,,,,"webexpcnow.exe",,RMM,"http://pcnow.webex.com/ - DOA as of 2024","Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,"Pcvisit*",,,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,"*.pcvisit.de",,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,"pcvisit.de",,,,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit-easysupport.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit_client.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,"pcvisit_service_client.exe",,RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pcvisit,,,,,"pcvisit*",RMM,"https://www.pcvisit.de/","Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,"Pilixo*",,,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"*.pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"download.pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,"pilixo.com",,,,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,"Pilixo_Installer*.exe",,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,"rdp.exe",,RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pilixo,,,,,"Pilixo*",RMM,"https://pilixo.freshdesk.com/support/solutions/articles/9000141879-device-connectivity-and-firewalls","Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","Pocket Cloud*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","PocketCloud*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)","Wyse*",,,,,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,"pocketcloud*.exe",,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,"pocketcloudservice.exe",,RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Cloud (Wyse)",,,,,"PocketCloud*",RMM,"https://wyse-pocketcloud.informer.com/2.1/","Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller","Pocket Controller*",,,,,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller","PocketController*",,,,,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"pocketcloudservice.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"pocketcontroller.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller",,,,"wysebrowser.exe",,RMM,"","Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","Pocket Controller*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","PocketController*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)","Soti Xsight*",,,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,"*.soti.net",,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,"soti.net",,,,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"XSightService.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"pocketcontroller.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,"wysebrowser.exe",,RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Pocket Controller (Soti Xsight)",,,,,"Pocket Controller*",RMM,"https://pulse.soti.net/support/soti-xsight/help/","Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ProxiPort,"ProxiPort*",,,,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/etc/proxiport/proxiport.conf",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/lib/systemd/system/proxiport.service",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"/usr/bin/proxiport",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"C:\Program Files\ProxiPort\proxiport.conf",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +ProxiPort,,,"C:\Program Files\ProxiPort\proxiport.exe",,,RMM,"https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/README.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/install.md,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/resource/Product.wxs,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/opt/systemd/proxiport.service,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/cmd/proxiport/servicemanagement/service.go,https://github.com/proximile/proxiport/blob/1dfd4a9e1ca10be24fa2ee287b92d0967a2c7962/docs/changes-from-openrport.md","ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort." +Pulseway,"Pulseway*",,,,,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,"pulseway.com",,,,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,"PCMonitorManager.exe",,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,"pcmonitorsrv.exe",,RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,,"MMSoft Design*",RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Pulseway,,,,,"Pulseway*",RMM,"https://intercom.help/pulseway/en/","Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance","QQ IM-remote assistance*",,,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance","QQIM-remoteassistance*",,,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"*.desktop.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"*.mdt.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"qq-messenger.en.softonic.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,"upload_data.qq.com",,,,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"QQProtect.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"qq.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,"qqpcmgr.exe",,RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,,"QQ*",RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"QQ IM-remote assistance",,,,,"Tencent*",RMM,"https://en.wikipedia.org/wiki/Tencent_QQ","QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","Quest KACE Agent*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","QuestKACEAgent*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)","formerly Dell KACE*",,,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,"*.kace.com",,,,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,,,"konea.exe",,RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quest KACE Agent (formerly Dell KACE)",,,,,"KACE Agent*",RMM,"https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function","Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist","Quick Assist*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist","QuickAssist*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist",,"*.support.services.microsoft.com",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Quick Assist",,,,"quickassist.exe",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/46","Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,"RAdmin*",,,,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,"radmin.com",,,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Program Files (x86)\Radmin Viewer 3\Radmin.exe",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\FamItrf2",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\FamItrfc",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,"C:\Windows\SysWOW64\rserver30\rserver3.exe",,,RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,,,"radmin*",RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RAdmin,,,,,"famatech*",RMM,"https://radmin-club.com/radmin/how-to-establish-a-connection-outside-of-lan/,https://helpdesk.radmin.com/radmin3help/,https://helpdesk.radmin.com/radmin3help/files/viewercmd.htm,https://helpdesk.radmin.com/radmin3help/files/cmd.htm","RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RDCMan,"RDCMan*",,,,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDCMan,,,"*\RDCMan-x86.exe",,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDCMan,,,"*\RDCMan.exe",,,RAT,"https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman,https://dirteam.com/sander/2021/06/24/remote-desktop-connection-manager-rdcman-is-back/,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0765","Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only." +RDPView,"RDPView*",,,,,RAT,"","RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RDPView,,,,"dwrcs.exe",,RAT,"","RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager","RES Automation Manager*",,,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager","RESAutomationManager*",,,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,"ivanti.com",,,,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wisshell*.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmc.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmc_deployer.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RES Automation Manager",,,,"wmcsvc.exe",,RMM,"https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1","RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"RG System (RG Supervision)","RG Supervision*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)","RG System*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)","RGSystem*",,,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"api.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"dashboard.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,"lisa.rg-supervision.com",,,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,,"C:\Program Files (x86)\RG-Supervision\*",,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +"RG System (RG Supervision)",,,"C:\Program Files\RG-Supervision\*",,,RMM,"https://bazaar.abuse.ch/sample/076b561bddf88c1482feefb2cbbc11a82b7829528988fd246a6e4a245eb48e73/,https://www.rgsystem.septeo.com/,https://info.rgsystem.fr/demande-demo,https://help.rgsystem.com/hc/en-us/articles/360020605399-Linux-Monitoring-agent,https://help.rgsystem.com/hc/en-us/articles/11614262449180-Deployment-Kits,https://help.rgsystem.com/hc/en-us/articles/360003611959-Deploying-the-agent-by-script,https://help.rgsystem.com/hc/en-us/articles/360003601340-Deploy-via-SFX-archive,https://help.rgsystem.com/hc/fr/articles/360016530440-Le-voisinage-r%C3%A9seau-en-d%C3%A9tail,https://help.rgsystem.com/hc/en-us/articles/360003611499-Remote-control-via-RDP-SSH-VNC,https://help.rgsystem.com/hc/en-us/articles/20039584263580-Windows-Update","RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage." +RMMCRAT,"RMMCRAT*",,,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMCRAT,,"softbymade.top",,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMCRAT,,,"C:\ProgramData\RMMAgent\*",,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst,https://github.com/pandare9x/Yara-Rules/blob/main/SEOPoison/rmmcrat.yar","RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent." +RMMmax,"RMMmax*",,,,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,"api.rmmmax.com",,,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"%ProgramData%\rmmmax\AgentService\RMMmaxAgentService.exe",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/Applications/RMMmax Agent.app/Contents/MacOS/RMMmax Agent",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/usr/local/bin/rmmmax-agent",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,"/var/rmmmax/agentservice/rmmmax_agent.py",,,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RMMmax,,,,"RMMmaxAgentSetup.exe",,RMM,"https://rmmmax.com/,https://rmmmax.com/pricing/,https://rmmmax.com/docs/rmmmax-agent-service/installation/download-agent-service/,https://rmmmax.com/docs/rmmmax-agent-service/installation/agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-download-installation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/linux-agent-service-operation/,https://rmmmax.com/docs/rmmmax-agent-service/installation/mac-osx-downlload-installation/,https://rmmmax.com/wp-content/uploads/2026/04/AgentService-Console.jpg","RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux." +RPort,"RPort*",,,,,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RPort,,"rport.io",,,,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RPort,,,,"rport.exe",,RMM,"https://kb.rport.io/using-the-remote-access","RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RdClient,"RdClient*",,,,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,"C:\Program Files (x86)\RdClient\*",,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,"C:\Program Files\RdClient\*",,,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"RdClientInstaller.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"SupportTool.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RdClient,,,,"rdclient.exe",,RAT,"https://rdclient.en.softonic.com/,https://geekflare.com/software/remote-desktop-client-software/","RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer." +RealVNC,"RealVNC*",,,,,RAT,"","RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RealVNC,,,,,"realvnc*",RAT,"","RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemSupp,"RemSupp*",,,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,"api.remsupp.com",,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,"download.remsupp.com",,,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\Programs\RemSupp\RemSupp.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\Programs\RemSupp\Uninstall RemSupp.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +RemSupp,,,"C:\Users\*\AppData\Local\remsupp-updater\installer.exe",,,RMM,"https://api.remsupp.com","RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com." +Remcos,"Remcos*",,,,,RMM,"","Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remcos,,,,"remcos*.exe",,RMM,"","Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmina,"Remmina*",,,,,RAT,"","Remmina is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,"Remmon*",,,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,"*.remmon.hu",,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,"remmon.hu",,,,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remmon,,,,"remmon.exe",,RMM,"https://remmon.hu","Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,"Remobo*",,,,,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,"remobo.en.softonic.com",,,,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo_client.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remobo,,,,"remobo_tracker.exe",,RMM,"https://www.remobo.com - DOA as of 2024","Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","Devolutions*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","Remote Desktop Manager*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Manager (Devolutions)","RemoteDesktopManager*",,,,,RAT,"","Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus","Remote Desktop Plus*",,,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus","RemoteDesktopPlus*",,,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,"donkz.nl",,,,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,,,"rdp.exe",,RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Desktop Plus",,,,,"Remote Desktop Plus*",RAT,"https://www.donkz.nl/","Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System","Remote Manipulator System*",,,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System","RemoteManipulatorSystem*",,,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,"*.internetid.ru",,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,"rmansys.ru",,,,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,,,"rfusclient.exe",,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Manipulator System",,,,"rutserv.exe",,RMM,"https://rmansys.ru/files/","Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Ripple","Remote Ripple*",,,,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple","RemoteRipple*",,,,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,"C:\Program Files (x86)\Remote Ripple\*",,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,"C:\Program Files\Remote Ripple\*",,,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Ripple",,,,"RemoteRipple.exe",,RMM,"https://remoteripple.com","Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control." +"Remote Utilities","Remote Utilities*",,,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities","RemoteUtilities*",,,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,"*.internetid.ru",,,,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,"rutserv.exe",,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,"rutview.exe",,RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote Utilities",,,,,"Remote Utilities*",RMM,"https://www.remoteutilities.com/download/","Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it","Remote.it*",,,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"api.remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"auth.api.remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,"remote.it",,,,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remote-it-installer.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remote.it.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Remote.it",,,,"remoteit.exe",,RMM,"https://docs.remote.it/introduction/get-started","Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteAgentAgent,"RemoteAgentAgent*",,,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteAgentAgent,,"app-af-agent-prod-009.azurewebsites.net",,,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteAgentAgent,,,"C:\Program Files\RemoteAgent\RemoteAgentAgent.exe",,,RAT,"https://www.threathuntinglabs.com/blog/from-seo-poisoning-to-custom-rmm-and-cobalt-strike,https://malbearlabs.com/posts/novel-malware-built-to-survive-the-analyst","RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent." +RemoteCall,"RemoteCall*",,,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"*.remotecall.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"*.startsupport.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,"remotecall.com",,,,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"agentu.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"raautoup.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcengmgru.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcmgrsvc.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rcstartsupport.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"remotesupportplayeru.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,"rxstartsupport.exe",,RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteCall,,,,,"RSUPPORT*",RMM,"https://help.remotecall.com/hc/en-us/articles/360005128814--RemoteCall-Server-List-For-Firewall","RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,"RemotePC*",,,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"*.remotedesktop.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"*.remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,"www.remotepc.com",,,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"*\RemotePCService.exe",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"*\RemotePC\*",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,"C:\Program Files (x86)\RemotePC\*",,,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"Idrive.File-Transfer",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"RemotePC.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"RemotePCService.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"idrive.RemotePCAgent",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"remotepchost.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"remotepcservice.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,"rpcsuite.exe",,RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,,"remotepc*",RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePC,,,,,"remotedesktop*",RMM,"https://www.remotedesktop.com/helpdesk/faq-firewall","RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,"RemotePass*",,,,,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,"remotepass.com",,,,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"remotepass-access.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"rpaccess.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePass,,,,"rpwhostscr.exe",,RMM,"https://www.remotepass.com/rpaccess.html - DOA as of 2024","RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemotePulse,"RemotePulse*",,,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,"remotepulse.io",,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,"www.remotepulse.io",,,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\InstallCore.exe",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\agent.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\defender-exclude.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\install.cmd",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemotePulse,,,"C:\Program Files (x86)\RemotePulseAgent\install.ps1",,,RMM,"https://www.remotepulse.io/,https://github.com/magicsword-io/LOLRMM/issues/226,https://www.virustotal.com/gui/file/4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53/behavior","RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io." +RemoteUtilities,"RemoteUtilities*",,,,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,"remoteutilities.com",,,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\Remote Manipulator System - Server\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\Remote Utilities\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"*\rutserv.exe",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,"C:\Program Files\Remote Utilities\*",,,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,"rutserv.exe",,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,"rutview.exe",,RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteUtilities,,,,,"Remote Utilities*",RMM,"","RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,"RemoteView*",,,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"*.content.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"*.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,"content.rview.com",,,,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"remoteview.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rv.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rvagent.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,"rvagtray.exe",,RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,,"RsDoctor*",RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RemoteView,,,,,"RemoteView*",RMM,"https://help.rview.com/hc/en-us/articles/360005175994--RemoteView-Server-list-for-firewall","RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Remotely,"Remotely*",,,,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/Library/LaunchDaemons/remotely-agent.plist",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/etc/systemd/system/remotely-agent.service",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/ConnectionInfo.json",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/Desktop/Remotely_Desktop",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"/usr/local/bin/Remotely/Remotely_Agent",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\ConnectionInfo.json",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\Desktop\Remotely_Desktop.exe",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\Remotely_Agent.exe",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +Remotely,,,"C:\Program Files\Remotely\etag.txt",,,RMM,"https://github.com/immense/Remotely,https://github.com/immense/Remotely/blob/master/README.md,https://github.com/immense/Remotely/blob/master/Agent/Agent.csproj,https://github.com/immense/Remotely/blob/master/Desktop.Win/Desktop.Win.csproj,https://github.com/immense/Remotely/blob/master/Shared/Utilities/EnvironmentHelper.cs,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Remotely.ps1,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-Ubuntu-x64.sh,https://github.com/immense/Remotely/blob/master/Server/wwwroot/Content/Install-MacOS-x64.sh,https://socprime.com/active-threats/voicemail-lure-leads-to-remote-access/,https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-agenda","Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions." +"Rocket Remote Desktop","Rocket Remote Desktop*",,,,,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop","RocketRemoteDesktop*",,,,,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop",,,,"RDConsole.exe",,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rocket Remote Desktop",,,,"RocketRemoteDesktop_Setup.exe",,RMM,"","Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Rodex RMM","Rodex RMM*",,,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM","RodexRMM*",,,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"rodex.cc",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,"www.rodex.cc",,,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,"C:\Program Files\Rodex\RodexAgent.exe",,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,"C:\Windows\.exe",,,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,,"RodexAgent.exe",,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +"Rodex RMM",,,,"rodexagent.exe",,RAT,"https://www.rodex.cc/,https://www.virustotal.com/gui/file/e08a097fe259aeca06133b5d1df226f9a2e79e79d7fb44cf5a3503c2b484c21b,https://www.virustotal.com/gui/domain/rodex.cc","Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs (""every byte of data stays on your server""), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents." +Roster,"Roster*",,,,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/Library/LaunchDaemons/com.roster.agent.plist",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/etc/roster/agent.yaml",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/etc/systemd/system/roster-agent.service",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/usr/local/bin/roster-agent",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"/var/log/roster-agent.log",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\Program Files\Roster\*",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\ProgramData\Roster\agent-state.json",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +Roster,,,"C:\ProgramData\Roster\agent.yaml",,,RMM,"https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/README.md,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/windows/install-agent.ps1,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/linux/pc-inventory-agent.service,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/deploy/macos/com.pc-inventory.agent.plist,https://github.com/boonkerz/roster/blob/4d753560c9fdb6e9b066eb934ccf07ab394c31a4/cmd/agent/main.go","Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use." +"Royal Apps","Royal Apps*",,,,,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps","RoyalApps*",,,,,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps",,,,"royalserver.exe",,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Apps",,,,"royalts.exe",,RMM,"https://www.royalapps.com/ts/win/download","Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server","Royal Server*",,,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server","RoyalServer*",,,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal Server",,"royalapps.com",,,,RMM,"https://royalapps.com/server/main/features","Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS","Royal TS*",,,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS","RoyalTS*",,,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS",,"royalapps.com",,,,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Royal TS",,,,"royalts.exe",,RMM,"","Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,"RuDesktop*",,,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,"*.rudesktop.ru",,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,"rudesktop.ru",,,,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,,,"rd.exe",,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RuDesktop,,,,"rudesktop*.exe",,RMM,"https://rudesktop.ru","RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RunSmart,"RunSmart*",,,,,RMM,"","RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RunSmart,,"runsmart.io",,,,RMM,"","RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +RustDesk,"RustDesk*",,,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"api.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"rs-ny.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,"web.rustdesk.com",,,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Program Files\RustDesk",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Program Files\RustDesk\RustDesk.exe",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Users\*\AppData\Local\rustdesk\*",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,"C:\Users\*\AppData\Local\rustdesk\rustdesk.exe",,,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,"rustdesk*.exe",,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,"rustdesk.exe",,RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +RustDesk,,,,,"rustdesk*",RMM,"https://rustdesk.com/docs/en/,https://rustdesk.com/docs/en/self-host/,https://rustdesk.com/docs/en/client/windows/,https://github.com/rustdesk/rustdesk/blob/master/src/core_main.rs,https://github.com/rustdesk/rustdesk/blob/master/src/platform/windows.rs,https://github.com/rustdesk/hbb_common/blob/main/src/config.rs,https://thedfirreport.com/2026/06/29/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-3/","RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment." +ScreenConnect,"ScreenConnect*",,,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"*.connectwise.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"*.screenconnect.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"control.connectwise.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,"instance-*-relay.screenconnect.com",,,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\*\ScreenConnect.ClientService.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\*\ScreenConnect.WindowsClient.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"*\ScreenConnect Client*\*",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"C:\Program Files (x86)\ScreenConnect Client ()\*",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,"C:\Program Files (x86)\ScreenConnect Client (Random)\ScreenConnect.ClientService.exe",,,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"ConnectWiseControl*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"Remote Workforce Client.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"connectwise*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect*.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect.clientservice.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,"screenconnect.windowsclient.exe",,RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"CONTINUUM MANAGED*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"ScreenConnect*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenConnect,,,,,"ConnectWise*",RMM,"https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/,https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill,https://newsletter.securityinbits.com/p/screenconnect-rmm-abuse-the-cloud,https://f4n6.co.uk/a-feedback-tool-that-isnt-screenconnect-rmm-abuse-hidden-in-a-12-mb-batch-file/,https://www.screenconnect.com/blog/customization-update,https://alluresecurity.com/blog/signal-noise-brand-was-real-app-wasnt/","ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,"ScreenMeet*",,,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,"*.screenmeet.com",,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,"*.scrn.mt",,,,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,"ScreenMeet.Support.exe",,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,"ScreenMeetSupport.exe",,RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ScreenMeet,,,,,"ScreenMeet*",RMM,"https://docs.screenmeet.com/docs/firewall-white-list","ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,"SecureCRT*",,,,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"*\SecureCRT.EXE",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"*\VanDyke Software\ClientPack\*",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SecureCRT,,,"C:\*\SecureCRT.EXE",,,RAT,"","SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,"Seetrol*",,,,,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,"seetrol.co.kr",,,,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolcenter.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolclient.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolmyservice.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolremote.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Seetrol,,,,"seetrolsetting.exe",,RMM,"http://www.seetrol.com/en/features/features3.php","Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud","Senso.cloud*",,,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,"*.senso.cloud",,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,"senso.cloud",,,,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"SensoClient.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"SensoService.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Senso.cloud",,,,"aadg.exe",,RMM,"https://support.senso.cloud/support/solutions/articles/79000116305-firewall-and-content-filter-configuration","Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sentinel RMM","Sentinel RMM*",,,,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM","SentinelRMM*",,,,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"/opt/sentinel-agent/sentinel-agent",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"/usr/local/sentinel-agent/sentinel-agent",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +"Sentinel RMM",,,"C:\ProgramData\SentinelAgent\sentinel-agent.exe",,,RMM,"https://github.com/codexX64/sentinel-rmm,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/README.md,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.py,https://github.com/codexX64/sentinel-rmm/blob/554a21d64ab3a03df81520e1519ecb97cc1466bf/agent/sentinel-agent.spec","Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit." +ServerEye,"ServerEye*",,,,,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,"*.server-eye.de",,,,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,"ServiceProxyLocalSys.exe",,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,"servereye*.exe",,RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,,"Server-Eye*",RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ServerEye,,,,,"ServerEye*",RMM,"https://www.servereye.de/wp-content/uploads/Anleitung-zur-Erstinstallation_aktuell.pdf","ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"SetMe PRO","SetMe PRO*",,,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO","SetMePRO*",,,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,"*.set.me",,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,"set.me",,,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,,"C:\Program Files (x86)\Techinline Ltd\SetMe Unattended\Client\SetMe_Client.exe",,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +"SetMe PRO",,,"C:\Program Files (x86)\Techinline Ltd\SetMe Unattended\Module\*\tinUnattendedModule.exe",,,RMM,"https://www.setme.net/,https://www.setme.net/Pricing,https://docs.set.me/getting-started/system-requirements,https://docs.set.me/unattended-access,https://www.setme.net/portals/0/whitepapers/SetMe-Security-Statement.pdf,https://github.com/magicsword-io/LOLRMM/issues/231,https://www.virustotal.com/gui/file/442ab6918b0b715b4a3c7f9e9c4a67fd27cb12094eb43653c1b2501e7f4f61e5,https://www.virustotal.com/gui/file/02e53fbb632c8af5e53d763b53c497b9c83493ff32406633e665ac7a01baa815","SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains." +ShellHub,"ShellHub*",,,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"*.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"cloud.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,"www.shellhub.io",,,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/etc/shellhub-agent/*",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/etc/systemd/system/shellhub-agent.service",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/usr/local/bin/shellhub-agent",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShellHub,,,"/var/lib/shellhub-agent/*",,,RAT,"https://shellhub.io/,https://github.com/shellhub-io/shellhub,https://lottunnels.github.io/lottunnels/Binaries/shellhub/","ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf ""https://cloud.shellhub.io/install.sh?tenant_id="" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the ""shell access"" category; documentation explicitly notes potential misuse by ""insiders as well as threat actors"" for ""a variety of malicious tasks"". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist." +ShowMyPC,"ShowMyPC*",,,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,"*.showmypc.com",,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,"showmypc.com",,,,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"SMPCSetup.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"showmypc*.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"showmypc.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,"smpcsetup.exe",,RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ShowMyPC,,,,,"ShowMyPC*",RMM,"https://showmypc.com/service/faq/ShowMyPCSecurityOverview1.pdf","ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SimpleHelp,"SimpleHelp*",,,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"160.191.182.41",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"192.144.34.42",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"51.255.19.178",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"51.255.19.179",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"dronemaker.org",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"microuptime.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"simple-help.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,"telesupportgroup.com",,,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,"%APPDATA%\JWrapper-SimpleSetup\*",,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,"C:\ProgramData\JWrapper-Remote Access\*",,,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"remote access.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"serviceconfig.xml",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simplegatewayservice.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simplehelpcustomer.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"simpleservice.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"spsrv.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"vhost.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,"windowslauncher.exe",,RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +SimpleHelp,,,,,"SimpleHelp*",RMM,"https://simple-help.com/remote-support,https://www.huntress.com/blog/employee-monitoring-simplehelp-abused-in-ransomware-operations,https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708,https://www.group-ib.com/blog/muddywater-infrastructure/","SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the ""Crazy"" ransomware (VoidCrypt family) reported by Huntress in February 2026." +Site24x7,"Site24x7*",,,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.cn",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.com",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.eu",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.in",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,"plus*.site24x7.net.au",,,,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"MEAgentHelper.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"MonitoringAgent.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"Site24x7PluginAgent.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Site24x7,,,,"Site24x7WindowsAgentTrayIcon.exe",,RMM,"https://support.site24x7.com/portal/en/kb/articles/which-ports-do-i-need-to-allow-access-in-my-firewall-to-use-site24x7-agent","Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,"SkyFex*",,,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"*.deskroll.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"deskroll.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,"skyfex.com",,,,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,"DeskRollUA.exe",,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,"Deskroll.exe",,RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SkyFex,,,,,"DeskRoll Remote Desktop*",RMM,"https://skyfex.com/","SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY","Solar-PuTTY*",,,,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"*\Solar-PuTTY.exe",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"*\Solar-Putty-v4\*",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Solar-PuTTY",,,"C:\Program Files\Solar-Putty-v4\*",,,RAT,"","Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System","Sophos-Remote Management System*",,,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System","Sophos-RemoteManagementSystem*",,,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophos.com",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophosupd.com",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,"*.sophosupd.net",,,,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"clientmrinit.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"mgntsvc.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Sophos-Remote Management System",,,,"routernt.exe",,RMM,"https://community.sophos.com/on-premise-endpoint/f/sophos-endpoint-software/5725/sophos-remote-management-system","Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,"Sorillus*",,,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,"*.sorillus.com",,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,"sorillus.com",,,,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,,,"Sorillus Launcher.exe",,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Sorillus,,,,"Sorillus-Launcher*.exe",,RMM,"https://sorillus.com/","Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SparkRAT,"SparkRAT*",,,,,RAT,"https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/README.md,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/scripts/build.client.sh,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/client/core/core.go,https://github.com/XZB-1248/Spark/blob/e2c8ce153d8494f7f1aa9999bfd86eef1bc6be79/server/handler/handler.go,https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/,https://hunt.io/blog/sparkrat-server-detection-macos-activity-and-malicious-connections","SparkRAT (Spark) is an open-source Go remote-access framework with a self-hosted controller that generates configured endpoint clients. It offers remote terminal, desktop, screenshot, file, and process functions. Public reporting has documented malicious SparkRAT deployments; that does not make every deployment of the upstream dual-use project malicious." +Splashtop,"Splashtop*",,,,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,"*.splashtop.com",,,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,"*\Splashtop\Splashtop Remote\Client for RMM\*",,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,"C:\Program Files (x86)\Splashtop\*",,,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Splashtop,,,,"strwinclt.exe",,RMM,"https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html","Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)","Beta*",,,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)","Splashtop*",,,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,"splashtop.com",,,,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SRManager.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SRServer.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"SplashtopSOS.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop (Beta)",,,,"Splashtop_Streamer_Windows*.exe",,RMM,"","Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote","Splashtop Remote*",,,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote","SplashtopRemote*",,,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.api.splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.api.splashtop.eu",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"*.relay.splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,"splashtop.com",,,,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"SplashtopSOS.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"Splashtop_Streamer_Windows*.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"sragent.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srmanager.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srserver.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"srservice.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,"strwinclt.exe",,RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Splashtop Remote",,,,,"Splashtop*",RMM,"https://support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services","Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,"SpyAnywhere*",,,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,"*.spytech-web.com",,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,"spyanywhere.com",,,,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SpyAnywhere,,,,"sysdiag.exe",,RMM,"https://www.spyanywhere.com/support.shtml","SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,"SunLogin*",,,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,"client.oray.net",,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,"sunlogin.oray.com",,,,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"OrayRemoteService.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"OrayRemoteShell.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,"sunlogin*.exe",,RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,,"Remote control service",RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SunLogin,,,,,"Shanghai Best Oray*",RMM,"https://sunlogin.oray.com/en/embed/software.html","SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,"SuperOps*",,,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superops.ai",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superopsalpha.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"*.superopsbeta.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"serv.superopsalpha.com",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,"superops.ai",,,,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,"superops.exe",,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,"superopsticket.exe",,RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperOps,,,,,"SuperOps*",RMM,"https://support.superops.com/en/articles/6632028-how-to-download-and-deploy-the-agent","SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,"SuperPuTTY*",,,,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*Downloads\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"*\superputty.exe",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SuperPuTTY,,,"C:\Downloads\SuperPuTTY\*",,,RAT,"","SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,"Supremo*",,,,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,"*.supremocontrol.com",,,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"%USERPROFILE%\\AppData\\Local\\Temp\\SupremoRemoteDesktop\\",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"*\\supremoremotedesktop\\supremosystem.exe",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,"C:\\ProgramData\\SupremoRemoteDesktop\\",,,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"SupremoSystem.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremo.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremohelper.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,"supremoservice.exe",,RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,,"NanoSystems*",RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Supremo,,,,,"SupRemo*",RMM,"https://www.supremocontrol.com/","Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,"Syncro*",,,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.kabutoservices.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.syncroapi.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"*.syncromsp.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"app.kabuto.io",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"attachments.servably.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"kabuto.io",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"kabutoservices.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"ld.aurelius.host",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"repairshopr.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"servably.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,"syncromsp.com",,,,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.App.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.Installer.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Kabuto.Service.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"KabutoSetup.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.App.Runner.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Installer.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Overmind.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"Syncro.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"SyncroLive.Agent.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,"SyncroLive.Service.exe",,RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,,"Syncro*",RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syncro,,,,,"Servably*",RMM,"https://community.syncromsp.com/t/syncro-exceptions-and-allowlists/2004","Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Synergy,"Synergy*",,,,,RAT,"https://symless.com/synergy","Synergy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,"SysAid*",,,,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\IliAS.exe",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\SysAidServer\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"*\SysAid\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +SysAid,,,"C:\Program Files\SysAidServer\*",,,RMM,"","SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,"Syspectr*",,,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,"*.syspectr.com",,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,"syspectr.com",,,,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"oolocker.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"oosyspectr.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,"syspectr.exe",,RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Syspectr,,,,,"O&O Syspectr*",RMM,"https://syspectr.com","Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM","Tactical RMM*",,,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM","TacticalRMM*",,,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,"docs.tacticalrmm.com",,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,"login.tailscale.com",,,,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,"tacticalrmm.exe",,RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,,"Tactical Techs*",RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Tactical RMM",,,,,"AmidaWare*",RMM,"https://docs.tacticalrmm.com","Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeamViewer,"TeamViewer*",,,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"*.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"client.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"router15.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,"taf.teamviewer.com",,,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,"C:\Program Files\TeamViewer\",,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,"teamviewer_desktop.exe",,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,"teamviewer_service.exe",,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,teamviewerhost,,RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeamViewer,,,,,"TeamViewer*",RMM,"https://community.teamviewer.com/English/kb/articles/4139-ports-used-by-teamviewer,https://arista.my.site.com/AristaCommunity/s/article/Security-Analysis-TeamViewer#,https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/troubleshooting/log-file-reading-incoming-connection/,https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html,https://github.com/Purp1eW0lf/Blue-Team-Notes","TeamViewer is a remote monitoring and management (RMM) tool." +TeleDesktop,"TeleDesktop*",,,,,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,"tele-desk.com",,,,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"pstlaunch.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"ptdskclient.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TeleDesktop,,,,"ptdskhost.exe",,RMM,"http://potomacsoft.com/ - DOA as of 2024","TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Teleport Connect","Teleport Connect*",,,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect","TeleportConnect*",,,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"*.teleport.sh",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"cdn.teleport.dev",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"reporting-connect.teleportinfra.sh",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,"usage.teleport.dev",,,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/Applications/Teleport Connect.app/*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/opt/Teleport Connect/*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"/usr/local/bin/tsh",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"C:\Program Files\Teleport Connect\*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,"C:\Users\*\AppData\Local\Programs\Teleport Connect\*",,,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +"Teleport Connect",,,,"Teleport Connect Setup-*.exe",,RAT,"https://goteleport.com/docs/connect-your-client/teleport-clients/teleport-connect/,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/electron-builder-config.js,https://github.com/gravitational/teleport/blob/master/web/packages/teleterm/src/staticConfig.ts","Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface." +Teramind,"Teramind*",,,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"*.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"rt.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"sentry.dev.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,"www.teramind.co",,,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/Applications/Teramind Agent.app",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/Applications/tmagent.app",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/bin/",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/bin/tmsysd",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"/usr/local/teramind/agent/etc/",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Package Cache\.unverified\agent",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\\{6D99445F-F40F-45CB-B433-06302DAE6C70}\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\\{6D99445F-F40F-45CB-B433-06302DAE6C70}\tmagentsvc.exe",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\Teramind Agent\config",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\config",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +Teramind,,,"C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}\updates\*",,,RMM,"https://www.teramind.co/,https://kb.teramind.co/en/articles/8791027-which-location-folder-directory-is-teramind-agent-installed-on,https://kb.teramind.co/en/articles/8791087-how-to-download-and-install-the-teramind-agent,https://kb.teramind.co/en/articles/8791095-how-to-verify-if-the-agent-is-installed-uninstalled-running,https://kb.teramind.co/en/articles/9182438-windows-agent-24-13-1482-2024-04-10,https://kb.teramind.co/en/articles/8791054-how-to-check-if-teramind-ip-addresses-hosts-and-ports-are-reachable,https://kb.teramind.co/en/articles/8791053-i-am-having-issues-with-the-firewall-and-proxy,https://www.virustotal.com/gui/file/e3ad70a1c8c540612dce4e90c3c619afafb429e297b5a1c9e1bbd4df985c4d24,https://www.virustotal.com/gui/file/998b69af0d3af49021d331d2e46a1734f38e28f03fb4dd3425e023ecc0c0a066,https://www.virustotal.com/gui/file/74e67c6671f6f987f4065e45ddd0cd7785be2330e2e0d273225a2b80bec405b1,https://www.virustotal.com/gui/domain/teramind.co,https://rules.emergingthreats.net/","Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a ""Revealed"" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a ""Hidden"" / ""Stealth"" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own." +TiFLUX,"TiFLUX*",,,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"*.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"agent.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"app.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"my.splashtop.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"tiflux.com.br",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"www.tiflux.com",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,"www.tiflux.com.br",,,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"%ProgramData%\Tiflux\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"/Applications/TiAgent.app",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\TiService.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\TiUpdateService.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\7zip\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\tar\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\dependencies\ultravnc\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\desktop\*",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\desktop\TiAgent.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +TiFLUX,,,"C:\Program Files (x86)\TiFLUX\si.exe",,,RMM,"https://tiflux.com/,https://tiflux.com/agente-inteligente-acesso-remoto/,https://tiflux.com/blog/configuracao-do-agente-remoto/,https://guia-de-uso.tiflux.com/faq/acesso-ao-tiflux/configuracoes-de-agente-remoto/instalacao-e-remocao-do-agente-remoto,https://guia-de-uso.tiflux.com/recursos-1/recursos/agente-mac,https://www.splashtop.com/partners/integrations/tiflux,https://x.com/James_inthe_box/status/2051375312894935077,https://app.any.run/tasks/775562f2-b0e5-49ba-9193-0170df9899b9,https://www.virustotal.com/gui/file/0528c5935296d99ec3df6806dbd42fa2f43921f36047bbb60bba4de2dfba0ab8,https://www.virustotal.com/gui/file/03effaf15e8df6ac014f354babb940a27bb005529197796f262d4eea457bc37d","TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server." +ToDesk,"ToDesk*",,,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,"*.todesk.com",,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,"todesk.com",,,,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"ToDesk_Service.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"ToDesk_Setup.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,"todesk.exe",,RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ToDesk,,,,,"ToDesk*",RMM,"https://www.todesk.com/","ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment","Total Software Deployment*",,,,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment","TotalSoftwareDeployment*",,,,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\Total Software Deployment\*",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\Tsdservice.exe",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"*\tniwinagent.exe",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,"C:\ProgramData\Total Software Deployment\*",,,RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,,,"Total Software Deployment",RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Total Software Deployment",,,,,"SoftInventive Lab",RMM,"","Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +TrustConnect,"TrustConnect*",,,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,"networkservice.cyou",,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,"trustconnectsoftware.com",,,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"*\TrustConnectAgent.exe",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\Program Files\TrustConnect Agent\*",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\Program Files\TrustConnect Agent\TrustConnectAgent.exe",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,"C:\ProgramData\TrustConnect\*",,,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,,"DocConnect.Agent.exe",,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +TrustConnect,,,,"TrustConnectAgent.exe",,RAT,"https://www.proofpoint.com/us/blog/threat-insight/dont-trustconnect-its-a-rat,https://github.com/magicsword-io/LOLRMM/issues/157,https://github.com/magicsword-io/LOLRMM/issues/150,https://www.virustotal.com/gui/file/cee6895f7df01da489c10bf5b83770ceede79ed4e1c8c4f8ea9787a4d035c79b,https://www.virustotal.com/gui/file/edde2673becdf84e3b1d823a985c7984fec42cb65c7666e68badce78bd0666c0,https://www.virustotal.com/gui/domain/trustconnectsoftware.com","TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate ""TrustConnect Software PTY LTD"" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named ""DocConnect"" / ""SHIELD OS"" hosted on networkservice[.]cyou." +UltraViewer,"UltraViewer*",,,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,"*.ultraviewer.net",,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,"ultraviewer.net",,,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"*\UltraViewer\",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"*\UltraViewer_Desktop.exe",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe",,,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_Desktop.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_Service.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"UltraViewer_setup*",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer_desktop.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,"ultraviewer_service.exe",,RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,,"DucFabulous*",RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +UltraViewer,,,,,"UltraViewer*",RMM,"https://www.ultraviewer.net/en/200000026-summary-of-ultraviewer-s-security-information.html","UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"UniSystem RMM","UniSystem RMM*",,,,,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM","UniSystemRMM*",,,,,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM",,,,"UniRMM.exe",,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +"UniSystem RMM",,,,"UniRMM.msi",,RMM,"https://xelvarunetio.pro/","UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution." +VIZOR,"VIZOR*",,,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"downloads.vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"mail.metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"vizor.cloud",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.metaquest.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.vector-networks.com",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,"www.vizor.cloud",,,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files (x86)\Vector\Asset Management Client\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files\Vector Networks Limited\LANutil32 Suite\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +VIZOR,,,"C:\Program Files\Vector\Asset Management Client\*",,,RMM,"https://www.vector-networks.com/,https://www.vizor.cloud/,https://www.vector-networks.com/it-asset-and-service-management/ITAM-SAM-products/asset-vizor.php,https://www.vizor.cloud/content/it-asset-management/network-discovery/,https://www.vector-networks.com/content/configuration-manager/network-device-discovery/,https://www.vector-networks.com/content/configuration-manager/overview/,https://www.vector-networks.com/content/configuration-manager/software-distribution/,https://www.vizor.cloud/content/wp-content/uploads/2019/12/VIZOR-SecurityTopics.pdf,https://www.vizor.cloud/content/support/vizor-security-summary/,https://www.vizor.cloud/resources/guides/VIZOR-Guide%20v2.5.2%20304.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/5.8/VAM-Manual.pdf,https://www.vector-networks.com/resources/asset-manager-pro/manual/6.0/VAM6-00-Man.pdf,https://www.vector-networks.com/resources/asset-manager-pro/release-notes/5.8/readme.txt,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v6_0-5b5735da73faf3a0a58c5de14d73336d-application.htm,https://www.advanceduninstaller.com/Vector-Asset-Management-Client-v5_7-d529f35fb427790979fd75d3b73d5fc2-application.htm,https://windowsbulletin.com/files/exe/vector-networks-limited/lanutil32-suite/clboot32-exe,https://www.glarysoft.com/startups/lanutil32distributionagent/cldistsvcexe/511206,https://www.virustotal.com/gui/file/435519ff10b0cfa569296dcd5dcbf470bfe5aafbe0471fcf99015a24691c0893,https://www.virustotal.com/gui/file/316d76102bdb089ed48188d2b95f6dbf9dc6ae070775d2b4404f486db87aa61e","VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName ""Vector Asset Management Agent"") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the ""Vector Scheduler"" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature (""any valid code can be executed"", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed)." +"VNC Connect","VNC Connect*",,,,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect","VNCConnect*",,,,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect",,,"*\RealVNC\VNC Server\*",,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"VNC Connect",,,"C:\Program Files\RealVNC\VNC Server\*",,,RAT,"","VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Veyon,"Veyon*",,,,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,"C:\Program Files (x86)\Veyon\*",,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,"C:\Program Files\Veyon\*",,,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-master.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-server.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-service.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-wcli.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +Veyon,,,,"veyon-worker.exe",,RAT,"https://veyon.io,https://github.com/veyon/veyon,https://docs.veyon.io/en/latest/","Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support." +"Vicarius vRx","Vicarius vRx*",,,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx","VicariusvRx*",,,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"*.vicarius.cloud",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-installer.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-patches.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-ap-southeast-3-release.s3.ap-southeast-3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-installer.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-patches.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-eu-central-1-release.s3.eu-central-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-installer.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-patches.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-release.s3.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-release.s3.us-east-1.amazonaws.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,"vicarius-static-organizationinstallations.vicarius-cdn.com",,,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"/Library/PrivilegedHelperTools/topiad",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"/usr/share/vicarius/*",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,"C:\Program Files\Vicarius\Topia\*",,,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Vicarius vRx",,,,"topiad.exe",,RMM,"https://customer-portal.vicarius.io/vrx-logs-and-files,https://customer-portal.vicarius.io/ports-opening-dns-whitelisting?hsLang=en,https://www.huntress.com/blog/two-inc-ransom-notes,https://www.vicarius.io/features/scripting,https://customer-portal.vicarius.io/vrx-my-scripts,https://customer-portal.vicarius.io/how-to-uninstall-vrx-agent,https://customer-portal.vicarius.io/macos-useful-commands","Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder." +"Visual Studio Dev Tunnel","Visual Studio Dev Tunnel*",,,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel","VisualStudioDevTunnel*",,,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"*.devtunnels.ms",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"*.rel.tunnels.api.visualstudio.com",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Visual Studio Dev Tunnel",,"global.rel.tunnels.api.visualstudio.com",,,,RAT,"https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security","Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,"Weezo*",,,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"*.weezo.me",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"*.weezo.net",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"weezo.en.softonic.com",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,"weezo.net",,,,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezo setup*.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezo.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,"weezohttpd.exe",,RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,,"Weezo*",RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Weezo,,,,,"Peer 2 World",RMM,"https://weezo.en.softonic.com","Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,"Xeox*",,,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,"*.xeox.com",,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,"xeox.com",,,,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_*.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_x64.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox-agent_x86.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xeox,,,,"xeox_service_windows.exe",,RMM,"https://help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW","Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,"Xpra*",,,,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra-Launcher.exe",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra-x86_64_Setup.exe",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"*\Xpra\*",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Xpra,,,"C:\Program Files (x86)\Xpra\*",,,RAT,"","Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent","Zabbix Agent*",,,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent","ZabbixAgent*",,,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,"zabbix.com",,,,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,,,"zabbix_agent*.exe",,RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zabbix Agent",,,,,"Zabbix*",RMM,"https://www.zabbix.com/documentation/current/en/manual/appendix/install/windows_agent","Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +Zecurit,"Zecurit*",,,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"app.zecurit.com",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"d1m8kha1zyjal6.cloudfront.net",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,"dms.zecurit.com",,,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/CommandProcessor",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/Installer",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/Service",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/Library/zecurit_agent/bin/ZecuritAccess.app/Contents/MacOS/ZecuritAccess",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/agentService",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/commandProcessor",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"/usr/local/zecurit_agent/bin/installer",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentAssetMgr.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentRegister.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritAgentTray.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritApplicationControlService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritCommandProcessor.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritLiveNotifier.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritRemoteTools.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderApp.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderAppUI.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Program Files\Zecurit\Agent\ZecuritScreenReaderService.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +Zecurit,,,"C:\Windows\Temp\Zecurit\ZecuritAgentUpgrader.exe",,,RMM,"https://zecurit.com/how-it-works/,https://zecurit.com/remote-access/,https://zecurit.com/remote-access/remote-troubleshooting-software/,https://zecurit.com/help/asset-management/device-enrollment/zecurit-agent-overview/,https://zecurit.com/help/asset-management/device-enrollment/manual-device-enrollment/enrollment-via-manual-download/,https://zecurit.com/help/asset-management/device-enrollment/silent-and-bulk-enrollment/enrollment-via-sccm/,https://zecurit.com/pricing/,https://x.com/patialavii/status/2102245788885622879,https://app.urlyze.io/scan/2cf6cdc9-4f7d-49c9-9755-7bd61d02a7a4","Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools." +ZeroTier,"ZeroTier*",,,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,"*.zerotier.com",,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,"zerotier.com",,,,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zero-powershell.exe",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zerotier*.exe",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,"zerotier*.msi",,RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,,"zero-powesrhell*",RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ZeroTier,,,,,"ZeroTier*",RAT,"https://my.zerotier.com/","ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist","Zoho Assist*",,,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist","ZohoAssist*",,,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com.au",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.eu",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zoho.in",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"*.zohoassist.jp",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"assist.zoho.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"downloads.zohocdn.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"downloads.zohodl.com.cn",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,"gateway.zohoassist.com",,,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,"*\ZA_Access.exe",,,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZMAgent.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZohoMeeting.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"ZohoURSService.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"Zohours.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"connect.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"toolsiq.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"za_connect.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"zaservice.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,"zohotray.exe",,RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"Zoho Assist",,,,,"Zoho*",RMM,"https://www.zoho.com/assist/kb/firewall-configuration.html","Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +"baramundi Management Suite","baramundi Management Suite*",,,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite","baramundiManagementSuite*",,,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"*.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"docs.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"isodownload.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,"www.baramundi.com",,,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files (x86)\bsag\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files (x86)\bsag\bma\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files\bsag\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +"baramundi Management Suite",,,"C:\Program Files\bsag\bma\*",,,RMM,"https://www.baramundi.com/en-us/management-suite/,https://www.baramundi.com/en-us/resources/demo-trial-version/,https://www.herdprotect.com/bma.exe-fcf742c1a764b713f94e0e377e4e4089c1274dfc.aspx,https://docs.baramundi.com/,https://www.virustotal.com/gui/file/465a46c2677345cadf578623c69755cefd45320bd5cc2094af11ba642a357026,https://www.virustotal.com/gui/file/47d9dbd0296aa8321b3f7fd99cd40ffabc8d11c5bd7a1d08e2f9c0f7ce87a64a/details,https://www.virustotal.com/gui/file/c7b570d3c52f67cd557cb76f54fc7e329a7f4429b2eaf652e871389701e61e62/details,https://www.virustotal.com/gui/file/1bd486d84ae929a501f2488e95ef51dc4e28bdac645beac06277092487568093/details","baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management." +eHorus,"eHorus*",,,,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,"ehorus.com",,,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,"C:\Program Files\ehorus_agent\*",,,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus standalone.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_agent.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_cmd.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_launcher.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +eHorus,,,,"ehorus_uit.exe",,RMM,"","eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,"ezHelp*",,,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,"*.ezhelp.co.kr",,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,"ezhelp.co.kr",,,,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezHelpManager.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezhelpclient.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,"ezhelpclientmanager.exe",,RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +ezHelp,,,,,"Mastersoft Corp*",RMM,"https://www.exhelp.co.kr","ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,"pcAnywhere*",,,,,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"awhost32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"awrem32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"pcaquickconnect.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +pcAnywhere,,,,"winaw32.exe",,RAT,"https://en.wikipedia.org/wiki/PcAnywhere","pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,"rdp2tcp*",,,,,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,,,,"rdp2tcp.exe",,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +rdp2tcp,,,,"rdp2tcp.py",,RAT,"https://github.com/V-E-O/rdp2tcp","rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available." +tmate,"tmate*",,,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,"*.tmate.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,"tmate.io",,,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,"/usr/bin/tmate",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,"/usr/local/bin/tmate",,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,tmate,,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate-ready",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate.bashrc",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." +tmate,,,,"tmate.sock",,RAT,"https://github.com/magicsword-io/LOLRMM/issues/106,https://github.com/tmate-io/tmate,https://tmate.io/","tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access." diff --git a/lookups/csv/remote_access_software.yml b/lookups/csv/remote_access_software.yml index db897ef6ee..b148e32ea6 100644 --- a/lookups/csv/remote_access_software.yml +++ b/lookups/csv/remote_access_software.yml @@ -1,15 +1,17 @@ name: remote_access_software id: f3b92ff9-667c-481f-b29d-458e10d48508 -version: 5 +version: 6 creation_date: '2022-08-22' -modification_date: '2026-05-13' +modification_date: '2026-10-08' author: Splunk Threat Research Team lookup_type: csv description: A list of Remote Access Software match_type: - - WILDCARD(remote_utility) - - WILDCARD(remote_domain) - - WILDCARD(remote_utility_fileinfo) + - WILDCARD(match_pattern) + - WILDCARD(domain) + - WILDCARD(file_path) + - WILDCARD(file_name) + - WILDCARD(file_info) min_matches: 1 max_matches: 1 case_sensitive_match: false