sigmamediumHunting

Remote Access Tool Services Have Been Installed - System

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

MITRE ATT&CK

T1543.003 T1569.002

privilege-escalationpersistenceexecution

Detection Query

selection:
  Provider_Name: Service Control Manager
  EventID:
    - 7045
    - 7036
  ServiceName|contains:
    - AmmyyAdmin
    - Atera
    - BASupportExpressSrvcUpdater
    - BASupportExpressStandaloneService
    - chromoting
    - GoToAssist
    - GoToMyPC
    - jumpcloud
    - LMIGuardianSvc
    - LogMeIn
    - monblanking
    - Parsec
    - RManService
    - RPCPerformanceService
    - RPCService
    - SplashtopRemoteService
    - SSUService
    - TeamViewer
    - TightVNC
    - vncserver
    - Zoho
condition: selection

Author

Connor Martin, Nasreddine Bencherchali

Created

2022-12-23

Data Sources

windowssystem

Platforms

windows

References

https://redcanary.com/blog/misbehaving-rats/

Tags

attack.privilege-escalationattack.persistenceattack.executionattack.t1543.003attack.t1569.002

Raw Content

title: Remote Access Tool Services Have Been Installed - System
id: 1a31b18a-f00c-4061-9900-f735b96c99fc
related:
    - id: c8b00925-926c-47e3-beea-298fd563728e
      type: similar
status: test
description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
references:
    - https://redcanary.com/blog/misbehaving-rats/
author: Connor Martin, Nasreddine Bencherchali
date: 2022-12-23
modified: 2023-06-22
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.t1543.003
    - attack.t1569.002
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID:
            - 7045
            - 7036
        ServiceName|contains:
            # Based on https://github.com/SigmaHQ/sigma/pull/2841
            - 'AmmyyAdmin' # https://www.ammyy.com/en/
            - 'Atera'
            - 'BASupportExpressSrvcUpdater' # https://www.systemlookup.com/O23/6837-BASupSrvcUpdater_exe.html
            - 'BASupportExpressStandaloneService' # https://www.systemlookup.com/O23/6839-BASupSrvc_exe.html
            - 'chromoting'
            - 'GoToAssist' # https://www.goto.com/it-management/resolve
            - 'GoToMyPC' # https://get.gotomypc.com/
            - 'jumpcloud'
            - 'LMIGuardianSvc' # https://www.logmein.com/
            - 'LogMeIn' # https://www.logmein.com/
            - 'monblanking'
            - 'Parsec'
            - 'RManService' # https://www.systemlookup.com/O23/7855-rutserv_exe.html
            - 'RPCPerformanceService' # https://www.remotepc.com/
            - 'RPCService' # https://www.remotepc.com/
            - 'SplashtopRemoteService' # https://www.splashtop.com/
            - 'SSUService'
            - 'TeamViewer'
            - 'TightVNC' # https://www.tightvnc.com/
            - 'vncserver'
            - 'Zoho'
    condition: selection
falsepositives:
    - Unknown
level: medium