| elastic |
Potential RMM Execution from a Commonly Abused Web Service |
production |
2026-10-22 |
| elastic |
First Time Seen Remote Monitoring and Management Tool |
production |
2026-10-06 |
| elastic |
First Time Seen RMM Service Hostname from Network DNS |
production |
2026-09-30 |
| elastic |
Multiple RMM Vendors Queried by a Single DNS Client |
production |
2026-09-30 |
| elastic |
Lure-Themed Internet-Delivered RMM Executable |
production |
2026-09-24 |
| elastic |
Newly Observed ScreenConnect Host Server |
production |
2026-09-18 |
| elastic |
Multiple Remote Management Tool Vendors on Same Host |
production |
2026-09-18 |
| elastic |
First Time Seen DNS Query to RMM Domain |
production |
2026-09-18 |
| elastic |
RMM Software Installation from a Commonly Abused Web Service |
production |
2026-09-18 |
| elastic |
Remote Management Access Launch After MSI Install |
production |
2026-09-18 |
| elastic |
First Time Seen RMM Signer Across the Environment |
production |
2026-09-18 |
| elastic |
Suspicious Shell Execution via Velociraptor |
production |
2026-09-18 |
| elastic |
RMM Software Installation from an Internet-Originated MSI |
production |
2026-09-18 |
| sigma |
Antivirus - Remote Access Tools Signature |
experimental |
2026-06-15 |
| sigma |
Antivirus - APT Malware Signature |
experimental |
2026-06-15 |
| sigma |
Antivirus - Exploitation Framework Signature |
stable |
2026-06-15 |
| sigma |
Remote Access Tool - Renamed MeshAgent Execution - Windows |
experimental |
2025-05-19 |
| sigma |
Remote Access Tool - Potential MeshAgent Execution - MacOS |
experimental |
2025-05-19 |
| sigma |
Remote Access Tool - Renamed MeshAgent Execution - MacOS |
experimental |
2025-05-19 |
| sigma |
Remote Access Tool - Potential MeshAgent Execution - Windows |
experimental |
2025-05-19 |
| sigma |
Remote Access Tool - AnyDesk Incoming Connection |
experimental |
2025-02-24 |
| sigma |
Suspicious Binary Writes Via AnyDesk |
test |
2025-02-24 |
| sigma |
Remote Access Tool - AnyDesk Execution |
test |
2025-02-24 |
| sigma |
Remote Access Tool - Anydesk Execution From Suspicious Folder |
test |
2025-02-24 |
| sigma |
QuickAssist Execution |
experimental |
2024-12-19 |
| sigma |
DNS Query To Remote Access Software Domain From Non-Browser App |
test |
2024-12-17 |
| sigma |
Remote Access Tool - MeshAgent Command Execution via MeshCentral |
test |
2024-09-22 |
| sigma |
Anydesk Temporary Artefact |
test |
2024-07-20 |
| sigma |
HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators |
test |
2024-06-27 |
| sigma |
HackTool - Inveigh Execution Artefacts |
test |
2024-06-27 |
| sigma |
DNS Query To AzureWebsites.NET By Non-Browser Process |
test |
2024-06-24 |
| sigma |
Potential CSharp Streamer RAT Loading .NET Executable Image |
test |
2024-06-22 |
| sigma |
Remote Access Tool - UltraViewer Execution |
test |
2024-03-14 |
| sigma |
Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution |
test |
2024-02-28 |
| sigma |
Remote Access Tool - Simple Help Execution |
test |
2024-02-23 |
| sigma |
TeamViewer Domain Query By Non-TeamViewer Application |
test |
2023-09-18 |
| sigma |
Potential Linux Amazon SSM Agent Hijacking |
test |
2023-08-03 |
| sigma |
Potential Amazon SSM Agent Hijacking |
test |
2023-08-02 |
| sigma |
Mstsc.EXE Execution With Local RDP File |
test |
2023-04-30 |
| sigma |
Suspicious Mstsc.EXE Execution With Local RDP File |
test |
2023-04-18 |
| sigma |
Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions |
test |
2023-04-13 |
| sigma |
Remote Access Tool - NetSupport Execution |
test |
2023-03-06 |
| sigma |
Remote Access Tool - AnyDesk Piped Password Via CLI |
test |
2023-03-05 |
| sigma |
Remote Access Tool - LogMeIn Execution |
test |
2023-03-05 |
| sigma |
Remote Access Tool - GoToAssist Execution |
test |
2023-03-05 |
| sigma |
Remote Access Tool - AnyDesk Silent Installation |
test |
2023-03-05 |
| sigma |
Remote Access Tool - ScreenConnect Execution |
test |
2023-03-05 |
| sigma |
Potential SocGholish Second Stage C2 DNS Query |
test |
2023-02-23 |
| sigma |
Atera Agent Installation |
test |
2022-12-25 |
| sigma |
Mesh Agent Service Installation |
test |
2022-11-28 |
| sigma |
TacticalRMM Service Installation |
test |
2022-11-28 |
| sigma |
Use of UltraVNC Remote Access Software |
test |
2022-10-02 |
| sigma |
Suspicious TSCON Start as SYSTEM |
test |
2022-05-27 |
| sigma |
ScreenConnect Temporary Installation Artefact |
test |
2022-02-13 |
| sigma |
GoToAssist Temporary Installation Artefact |
test |
2022-02-13 |
| sigma |
TeamViewer Remote Session |
test |
2022-01-30 |
| sigma |
Installation of TeamViewer Desktop |
test |
2022-01-28 |
| sigma |
Potential Remote Desktop Connection to Non-Domain Host |
test |
2021-11-27 |
| sigma |
Hijack Legit RDP Session to Move Laterally |
test |
2021-11-27 |