Windows RMM Tool Execution

name: Windows RMM Tool Execution
id: 4afbd373-b769-4f82-8375-41e0153e46f9
version: 2
creation_date: '2026-05-05'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    Detects process creation events of various remote access tools.
    Remote management tools, when used for legitimate purposes, can help IT professionals and system administrators remotely access and manage computer systems.
    However, threat actors may exploit these tools for malicious purposes.
data_source:
    - Sysmon EventID 1
search: |-
    `sysmon`
    EventID = 1
    (
        Company IN (
            "AmidaWare*",
            "Ammyy LLC*",
            "AnyDesk Software*",
            "ATERA Networks*",
            "bomgar*",
            "FleetDeck*",
            "GoTo, Inc*",
            "IDrive Inc*",
            "LogMeIn, Inc*",
            "MMSOFT Design*",
            "N-able*",
            "NetSupport Ltd*",
            "NinjaRMM*",
            "Remote Utilities*",
            "SimpleHelp*",
            "Servably*",
            "ScreenConnect*",
            "Splashtop*",
            "TeamViewer Germany*",
            "ZOHO Corporation*"
        )

        OR Description IN (
            "Advanced Monitoring Agent*",
            "AnyDesk*",
            "Ammyy Admin*",
            "AteraAgent*",
            "BeyondTrust Remote Support*",
            "FleetDeck*",
            "GoToAssist*",
            "GoToMyPC*",
            "Kaseya Live Connect*",
            "N-able*",
            "NetSupport Client Application*",
            "NinjaRMM*",
            "Pulseway*",
            "RemotePC*",
            "Remote Utilities*",
            "ScreenConnect*",
            "SimpleHelp Remote*",
            "Splashtop*",
            "Tactical RMM Agentz*",
            "Take Control Agent*",
            "Zoho Assist*"
        )

        OR Product IN (
            "Advanced Monitoring Agent*",
            "AnyDesk*",
            "Ammyy Admin*",
            "AteraAgent*",
            "BeyondTrust Remote Support*",
            "FleetDeck*",
            "GoToAssist*",
            "GoToMyPC*",
            "Kaseya Live Connect*",
            "NetSupport Remote Control*",
            "NetSupport Manager*",
            "NinjaRMM*",
            "Pulseway*",
            "Remote Access*",
            "Remote Support*",
            "Remote Utilities*",
            "RemotePC*",
            "Syncro*",
            "ScreenConnect*",
            "Splashtop*",
            "Tactical RMM Agent*",
            "Take Control Agent*",
            "TeamViewer*",
            "Zoho Assist*"
        )

        OR Image IN (
            "*AgentPackage*",
            "*AnyDesk.exe*",
            "*AteraAgent.exe*",
            "*BASupSrvc*",
            "*fleetdeck*",
            "*level.exe*",
            "*MeshAgent*",
            "*MspPlatform\\PME\\Installers*",
            "*NableCommand*",
            "*N-able Technologies*",
            "*NinjaRMM*",
            "*nxexec.exe*",
            "*nxserv*",
            "*nxplayer*",
            "*PCMonitor*",
            "*Pulseway*",
            "*remcmdstub.exe*",
            "*rustdesk.exe*",
            "*ScreenConnect*",
            "*Splashtop*",
            "*SRAgent.exe*",
            "*tacticalrmm.exe*",
            "*TakeControlTechConsole*",
            "*tailscale*",
            "*TeamViewer*",
            "*ZA_Connect*",
            "*ZMAgent*",
            "*ZohoMeeting*"
        )
    )

    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      by Computer Company Description Product Image action
         dest original_file_name parent_process
         parent_process_exec parent_process_guid
         parent_process_id parent_process_name
         parent_process_path process_hash
         process_integrity_level user user_id
         vendor_product

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_rmm_tool_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Legitimate IT staff often use remote management tools for system maintenance and troubleshooting. Filter alerts to exclude trusted administrative activities.
references:
    - https://github.com/LivingInSyn/RMML/tree/main/RMMs
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
    - https://www.synacktiv.com/en/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects
drilldown_searches:
    - earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
      name: View the detection results for - "$user$" and "$dest$"
      search: '%original_detection_search% | search  user = "$user$" dest = "$dest$"'
    - name: View risk events for the last 7 days for - "$user$" and "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Potential RMM tool execution observed on $dest$ via $Image$.
threat_objects:
    - field: Image
      type: process_name
analytic_story:
    - NetSupport RMM Tool Abuse
    - Remote Monitoring and Management Software
    - Suspicious User Agents
asset_type: Endpoint
mitre_attack_id:
    - T1219
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1219/snapattack/snapattack.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit