{
  "Name": "Absolute (Computrace)",
  "Category": "RMM",
  "Description": "Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2026-09-02",
  "Details": {
    "Website": "https://www.absolute.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "rpcnet.exe",
      "ctes.exe",
      "ctespersistence.exe",
      "cteshostsvc.exe",
      "rpcld.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "search.namequery.com",
          "*.search.namequery.com",
          "server.absolute.com",
          "*.server.absolute.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/absolute__computrace__network_sigma.yml",
      "Description": "Detects potential network activity of Absolute (Computrace) RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/absolute__computrace__processes_sigma.yml",
      "Description": "Detects potential processes activity of Absolute (Computrace) RMM tool"
    }
  ],
  "References": [
    "https://community.absolute.com/s/article/Understanding-Absolutes-Endpoint-Agents-Rpcnet-CTES-and-search-namequery-com"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Absolute Software Corp.",
        "certificate_thumbprint": "7F15551E564615F929E65B19B1C695D78DB51810",
        "certificate_der_base64": "MIIHDTCCBPWgAwIBAgIQDHHem87X1Itv1IhZk/COwzANBgkqhkiG9w0BAQsFADB7MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAPBgNVBAoMCFNTTCBDb3JwMTcwNQYDVQQDDC5TU0wuY29tIEVWIENvZGUgU2lnbmluZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIzMB4XDTI0MTIxOTIyMTUyNFoXDTI3MTIxOTIyMTUyNFowgesxCzAJBgNVBAYTAkNBMRkwFwYDVQQIDBBCcml0aXNoIENvbHVtYmlhMRIwEAYDVQQHDAlWYW5jb3V2ZXIxIDAeBgNVBAoMF0Fic29sdXRlIFNvZnR3YXJlIENvcnAuMRIwEAYDVQQFEwlCQzE0MzA5OTExIDAeBgNVBAMMF0Fic29sdXRlIFNvZnR3YXJlIENvcnAuMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjEhMB8GCysGAQQBgjc8AgECDBBCcml0aXNoIENvbHVtYmlhMRMwEQYLKwYBBAGCNzwCAQMTAkNBMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAou4xEUJCc0Wv0/F/ZMh2XtBYpFd8L5rj+Gl2Eu4tLUzKY/Hyn3kYa1eLQ+U+gkdS+0XG9H75ocT2MT7ds0PWP/eUe6TYY2WGEUsTmMllQkMNVw75dfsxe6QJG2AYiI0E9mtF3p1AGfWHobHWEUBVjk5vEoFXwR/H8GQkaBL2eB1aD0IUUajpBpdTdRKdWellzfHyLfaq5CvXu4jp4VVt4EdvCfjcBpZTjZnYj5dmTaNSz09WU8CcgiYDzKsbhoPDDz6HlBC6gVSN0fVX1M7oyEJOdy3nFFCRIHU5mXUAku6SZgPiR4bH8jexhrTDmZtCas86+VXt1XEKdjO3ZdJ8blZG7kfgppJruwkfvJ644MlRk4dOu//kUrl8u1ZNFPTP/JzoOSli8LzdKsezPpjTtkGzJu2ZjO/KrKGcDa9MnBxFI2HCA3JW31cN+Hgm7MNq3AKc/XPkgaYT11IJFf8VLDTF5+HDd1aPzZud85kc7aDpu6zzuekIc+J+zrbu69ZlAgMBAAGjggGaMIIBljAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFDa9Sf8xLOuvakD+mcAW7br8SN1fMH0GCCsGAQUFBwEBBHEwbzBLBggrBgEFBQcwAoY/aHR0cDovL2NlcnQuc3NsLmNvbS9TU0xjb20tU3ViQ0EtRVYtQ29kZVNpZ25pbmctUlNBLTQwOTYtUjMuY2VyMCAGCCsGAQUFBzABhhRodHRwOi8vb2NzcHMuc3NsLmNvbTBQBgNVHSAESTBHMAcGBWeBDAEDMDwGDCsGAQQBgqkwAQMDAjAsMCoGCCsGAQUFBwIBFh5odHRwczovL3d3dy5zc2wuY29tL3JlcG9zaXRvcnkwEwYDVR0lBAwwCgYIKwYBBQUHAwMwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybHMuc3NsLmNvbS9TU0xjb20tU3ViQ0EtRVYtQ29kZVNpZ25pbmctUlNBLTQwOTYtUjMuY3JsMB0GA1UdDgQWBBTEv0+NTT8ukvFlkofaeEyCBCxYgTAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBAB3rOwwuYFR6I5uL1SlwDWW+AsIBCMXRvQLqE9/Ic318ufnvnMTYvwPsl9X6Fvq1+42cfcerWHCGHPbLtVpZNx4+7gf75cRSuwGjo0KTbrPQi2oxeWT4+rCdwNIIvgQvz7pBjclsF9/qwFrfQdgbK1o/qtOvItt1wI2UJ+6iOX19xwd2i/6MistU2E5einlvHzW5alvAEyyJjhRQZf0vHWVTGCcAd3R1Ani0hpkiQXPOXUDt/ZIluqnRTjCsxIrTOZU7BfojCpBBFQ3CIv9Q4zJlx0Cxd9WYT/3R/3d8wHnTG4jWMHDfTTJ+qdWvlUZ8hgAEwHCatmOzu5ePjSUDKKpbNHcDyfM31VwB9pzJERQx7gtjtN/0tA8sjEzAIQyMS3rR8M/UZRJeW0o4yeoc7T6i95fnsYBs6t4rdHrWtR5jwKZ7BginQJw7r6tFmSux++zcPmGAROxZqYO8z8V9YiTNQqwf24xN5i2OchPpIgtNSHhCt5dPAq/NfXpKGXN+SkOfPWU7tmRTh1gGborgPGkLGOgb5uKfq6OhYb3qW/QsLw6nYP82Gc0r1r+EVCApQn+km8GJ7OtIrIlKMJ002dBpr01PiOdVP7pDg75EMUAb4khSXY48KRm4jmoZkySwCChPtYWZWBNDa8ib676+NEmpdpPqwALD4avkHGz+Nyca",
        "src_file_sha256": "76a4272310b3f5151939eee0e63b61cee712d88af5b1606202360147082adbc1",
        "src_file_path": "downloaded_files/absolute_(computrace)/76a4272310b3f5151939eee0e63b61cee712d88af5b1606202360147082adbc1",
        "src_file_company": "Absolute Software Corporation"
      }
    ]
  }
}