Uncommon remote monitoring and management tool

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Remote Access Tools (T1219)
Severity	Low

Description

An uncommon Remote Monitoring and Management (RMM) product was observed.

Attacker's Goals

• Accessing a remote machine with full interactive graphic interface capabilities.

Investigative actions

• Check if the product usage is approved.
• Ask the owners of the machine if they knowingly used this software.
• Investigate why the software was being used.
• Check if it was executed remotely or locally.

Variations

Uncommon renamed remote monitoring and management tool

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Remote Access Tools (T1219)
Severity	Medium

Description

An uncommon renamed Remote Monitoring and Management (RMM) product was observed.

Attacker's Goals

• Accessing a remote machine with full interactive graphic interface capabilities.

Investigative actions

• Check if the product usage is approved.
• Ask the owners of the machine if they knowingly used this software.
• Investigate why the software was being used.
• Check if it was executed remotely or locally.

Uncommon remote monitoring and management tool (browser origin)

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Remote Access Tools (T1219)
Severity	Informational

Description

An uncommon Remote Monitoring and Management (RMM) product was observed. (browser origin).

Attacker's Goals

• Accessing a remote machine with full interactive graphic interface capabilities.

Investigative actions

• Check if the product usage is approved.
• Ask the owners of the machine if they knowingly used this software.
• Investigate why the software was being used.
• Check if it was executed remotely or locally.

Uncommon remote monitoring and management tool extracted from an internet-downloaded archive and executed

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Remote Access Tools (T1219)
Severity	Low

Description

An uncommon Remote Monitoring and Management (RMM) product extracted from an internet-downloaded archive and executed.

Attacker's Goals

• Accessing a remote machine with full interactive graphic interface capabilities.

Investigative actions

• Check if the product usage is approved.
• Ask the owners of the machine if they knowingly used this software.
• Investigate why the software was being used.
• Check if it was executed remotely or locally.

Uncommon remote monitoring and management tool downloaded from an uncommon source and executed

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Remote Access Tools (T1219)
Severity	Medium

Description

An uncommon Remote Monitoring and Management (RMM) product downloaded from an uncommon source and executed.

Attacker's Goals

• Accessing a remote machine with full interactive graphic interface capabilities.

Investigative actions

• Check if the product usage is approved.
• Ask the owners of the machine if they knowingly used this software.
• Investigate why the software was being used.
• Check if it was executed remotely or locally.