| elastic |
Potential RMM Execution from a Commonly Abused Web Service |
production |
2026-10-22 |
| splunk |
Detect Remote Access Software Usage Registry |
production |
2026-10-19 |
| splunk |
Detect Remote Access Software Usage Process |
production |
2026-10-19 |
| splunk |
Detect Remote Access Software Usage File |
production |
2026-10-19 |
| splunk |
Cisco Secure Firewall - Remote Access Software Usage Traffic |
production |
2026-10-08 |
| splunk |
Detect Remote Access Software Usage URL |
production |
2026-10-08 |
| splunk |
Detect Remote Access Software Usage DNS |
production |
2026-10-08 |
| splunk |
Cisco Secure Firewall - Communication Over Suspicious Ports |
production |
2026-10-08 |
| splunk |
Detect Remote Access Software Usage Traffic |
production |
2026-10-08 |
| splunk |
Detect Remote Access Software Usage FileInfo |
production |
2026-10-08 |
| elastic |
First Time Seen Remote Monitoring and Management Tool |
production |
2026-10-06 |
| elastic |
First Time Seen RMM Service Hostname from Network DNS |
production |
2026-09-30 |
| elastic |
Multiple RMM Vendors Queried by a Single DNS Client |
production |
2026-09-30 |
| elastic |
Lure-Themed Internet-Delivered RMM Executable |
production |
2026-09-24 |
| splunk |
HTTP RMM User Agent |
production |
2026-09-22 |
| elastic |
Potential Tunneling via Tailscaled |
production |
2026-09-18 |
| elastic |
Potential Traffic Tunneling using QEMU |
production |
2026-09-18 |
| elastic |
Remote GitHub Actions Runner Registration |
production |
2026-09-18 |
| elastic |
Shell Execution via Elastic Endpoint |
production |
2026-09-18 |
| elastic |
VNC (Virtual Network Computing) from the Internet |
production |
2026-09-18 |
| elastic |
VNC (Virtual Network Computing) to the Internet |
production |
2026-09-18 |
| elastic |
First Time Seen DNS Query to RMM Domain |
production |
2026-09-18 |
| elastic |
Multiple Remote Management Tool Vendors on Same Host |
production |
2026-09-18 |
| elastic |
First Time Seen RMM Signer Across the Environment |
production |
2026-09-18 |
| elastic |
Newly Observed ScreenConnect Host Server |
production |
2026-09-18 |
| elastic |
Quick Assist Full Control Sharing Mode Enabled |
production |
2026-09-18 |
| elastic |
Potential REMCOS Trojan Execution |
production |
2026-09-18 |
| elastic |
Remote Management Access Launch After MSI Install |
production |
2026-09-18 |
| elastic |
NetSupport Manager Execution from an Unusual Path |
production |
2026-09-18 |
| elastic |
RMM Software Installation from a Commonly Abused Web Service |
production |
2026-09-18 |
| elastic |
RMM Software Installation from an Internet-Originated MSI |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
Remote File Copy via TeamViewer |
production |
2026-09-18 |
| elastic |
Attempt to Establish VScode Remote Tunnel |
production |
2026-09-18 |
| elastic |
Suspicious Shell Execution via Velociraptor |
production |
2026-09-18 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved for agentDownloadURL |
rev 1 |
2026-09-17 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved |
rev 1 |
2026-09-17 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Outbound Command Sent |
rev 1 |
2026-09-17 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Registration |
rev 1 |
2026-09-17 |
| suricata |
ET INFO Zecurit RMM Activity - Agent Exfil User Fingerprint |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Registration |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Outbound Command Sent |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved for agentDownloadURL |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Exfil User Fingerprint |
rev 1 |
2026-09-17 |
| elastic |
AWS SSM Agent Registered via Hybrid Activation |
production |
2026-09-14 |
| splunk |
Windows Level RMM Watchdog Task Created |
production |
2026-05-13 |
| splunk |
Windows RMM Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Remote Access Software RMS Registry |
production |
2026-05-13 |
| splunk |
Windows Remote Access Software BRC4 Loaded Dll |
production |
2026-05-13 |
| splunk |
Windows Level RMM PowerShell Script Installer |
production |
2026-05-13 |
| suricata |
ET JA3 Hash - Possible SoftEther Server-Side Traffic |
rev 1 |
2026-03-13 |
| suricata |
ET REMOTE_ACCESS SimpleHelp RMM machine ping Request to Server |
rev 1 |
2026-03-02 |
| snort |
ET INFO SimpleHelp RMM machine ping Request to Server |
rev 1 |
2026-03-02 |
| snort |
ET INFO SimpleHelp RMM lossyproc Request to Server |
rev 1 |
2026-03-02 |
| suricata |
ET REMOTE_ACCESS SimpleHelp RMM lossyproc Request to Server |
rev 1 |
2026-03-02 |
| sigma |
OpenEDR Spawning Command Shell |
experimental |
2026-02-19 |
| sigma |
Potentially Suspicious File Creation by OpenEDR's ITSMService |
experimental |
2026-02-19 |
| suricata |
ET INFO Redirect to MSP360 Software Download Request M2 |
rev 2 |
2026-02-18 |
| suricata |
ET INFO Redirect to MSP360 Software Download Request M1 |
rev 1 |
2026-01-26 |
| suricata |
ET INFO Download Request for MSP360 Software |
rev 1 |
2026-01-26 |
| suricata |
ET INFO POST to MSP360 Backup Services |
rev 1 |
2026-01-26 |
| snort |
ET INFO Redirect to MSP360 Software Download Request M1 |
rev 1 |
2026-01-26 |
| sigma |
Renamed Visual Studio Code Tunnel Execution |
test |
2025-10-29 |
| sigma |
Visual Studio Code Tunnel Execution |
test |
2025-10-29 |
| sigma |
Suspicious Velociraptor Child Process |
experimental |
2025-08-29 |
| suricata |
ET INFO ISLOnline RMM Installer Activity |
rev 1 |
2025-07-24 |
| snort |
ET INFO ISLOnline RMM Installer Activity |
rev 1 |
2025-07-24 |
| sigma |
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server |
experimental |
2025-05-29 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |