{
  "Name": "Ivanti Remote Control",
  "Category": "RMM",
  "Description": "Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://www.ivanti.com/use-cases/remote-control-all-of-my-devices-worldwide",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "IvantiRemoteControl.exe",
      "ArcUI.exe",
      "AgentlessRC.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.ivanticloud.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/ivanti_remote_control_network_sigma.yml",
      "Description": "Detects potential network activity of Ivanti Remote Control RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/ivanti_remote_control_processes_sigma.yml",
      "Description": "Detects potential processes activity of Ivanti Remote Control RMM tool"
    }
  ],
  "References": [
    "https://rc1.ivanticloud.com/"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "dlgserver"
    ],
    "company_names": [],
    "signer_names": [
      "Ivanti, Inc."
    ],
    "certificates": [
      {
        "signer_name": "Ivanti, Inc.",
        "certificate_thumbprint": "E059339A3F58FD4AFDB4296E1EDE30FA77136431",
        "tbs_sha256": "F62F22AE6537E816B945FE23AE925AA41276D9CE50B1C5F619A4FB652D90DC13",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIFIzCCBAugAwIBAgIQDh26LAQFVcbFDsKQFl7KczANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQgQ29kZSBTaWduaW5nIENBMB4XDTIxMDQyMjAwMDAwMFoXDTIzMDQyNzIzNTk1OVowYTELMAkGA1UEBhMCVVMxDTALBgNVBAgTBFV0YWgxFTATBgNVBAcTDFNvdXRoIEpvcmRhbjEVMBMGA1UEChMMSXZhbnRpLCBJbmMuMRUwEwYDVQQDEwxJdmFudGksIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCs7yOJ9dOZT1Jj9WGKAkU93bHmmqlTc3GXW4jZOMUxXbj9cd9NVHvQv97RIwB6hzWSHvh7dlfM7yumub26IVMuxGlnNEWwLCXHySr+V12o42WiV7S3F2emyDZguF9rL/7JSobXdFImxkXD79KjHeIZhMd2yFH3b9YTe95vh7TcEQoIfP5ZxvuFh4d4avVSmcP1+RGVxONLkuAF+B3AN67DkA+VTeIHmt4Fq4Px09jzZY/sgJ8oF4ZRkEl/rB1jHQSYopH7y0KjED+6MtiC/AFVvDNHKxTdcFRRghmVb2WYKb422Yr5Wd/hK/PccMy5AK2Fe9AqIL0AOzxfbQ5WV6atAgMBAAGjggHEMIIBwDAfBgNVHSMEGDAWgBRaxLl7KgqjpepxA8Bg+S32ZXUOWDAdBgNVHQ4EFgQUHrMBfINjEJ02mJ58rsxyxfwiJdcwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMHcGA1UdHwRwMG4wNaAzoDGGL2h0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zaGEyLWFzc3VyZWQtY3MtZzEuY3JsMDWgM6Axhi9odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc2hhMi1hc3N1cmVkLWNzLWcxLmNybDBLBgNVHSAERDBCMDYGCWCGSAGG/WwDATApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwCAYGZ4EMAQQBMIGEBggrBgEFBQcBAQR4MHYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBOBggrBgEFBQcwAoZCaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJRENvZGVTaWduaW5nQ0EuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggEBADPphDz5FefTbBzCiuTAvCdTCCznwl9bekBOqBc6LF8rK4IlQNeQtpNSh9Ub+q/wwgN5l5Vbr9HlTkdGm1ssCxmkRgErjni7tg3vyaTz82X38Rh2fL2Crw82CfWiSUy/LtolixLNS7CF9S2RmE43YLyC92m0tkaxTh8elNC/LoUpjnOKJNQQjillqkPHN74rQ7V1yh248ZF6WLiaOeOrsbRhZNPBEMzuE6JTNQgNKXsTcuOWc5+bl/Ctrm1qMvk1PUlRSSRQGUjfJ4AWaBK3E3qK6p0t8hAFejUS/DYjngDaGurVDRUS6td/pney8aVMPoRKKBz3/4Maik9WqhfR2cE="
      },
      {
        "signer_name": "Ivanti, Inc.",
        "certificate_thumbprint": "B310DCA4816C8E3E41E6C72BBB67A255AD8E0363",
        "tbs_sha256": "48CD3051C77583166A1F530EE0F3DA941183A3A201A7205E76521E9FDB55C9CE",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIHWTCCBUGgAwIBAgIQBsyN0tcIuQcyg45nl3swfzANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIzMDMyMzAwMDAwMFoXDTI2MDQyOTIzNTk1OVowYTELMAkGA1UEBhMCVVMxDTALBgNVBAgTBFV0YWgxFTATBgNVBAcTDFNvdXRoIEpvcmRhbjEVMBMGA1UEChMMSXZhbnRpLCBJbmMuMRUwEwYDVQQDEwxJdmFudGksIEluYy4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJ3RSNQX//5l85k0tbY0veBq3kRuTO5TKZgJC00IR0Y3xMpPj4HzM32fPOzsV6ooV6AcKM/3X20ENhHE2Cj/FB3v+ptWOniYRRxtJhaRZlRxs7saEK+xirr+kB+2vtYpfsgerArxOb19exJ/OSnzYFbMzsoZcKhm0IEcik/qkkDttnmD1KaR8wSxZi434bwByV9rTme23Vt783sqWjZjEtjtMGUo4cxHvFoewmvItfIp0JYoIwfnjRVNK/uRRnIAqosnxmH5Lr8IatWRFqVH6WaVIf5Fn+NDPUVF8UI2+78FvbZfeddNNNmGqr8m/j6BYZLWW4krsTlIcIIUP5aO8jmg6soQln05/uSTgQstlhm3UEc/G+BPMdzYvXDNgcMCqfOw+fsXPgTbfH5VryNrVA2GZ3pkkumLmTPr0lqgI+qkBE/YFuDGkPJanQl74/rxhFZEgzt0hJRfsF7u7TITry+4MFyhOjob+sq4yWwQ71QyY28ivLt8lQfZsBH6mKUk8Jgge6hk45sPHd7nXSOeAO2uMr+iBr/u2Wf1z5/KqB+ftG9KaHmSEmeU9uLo5z/3g4MtUt6F/ZE+GRXE/sJg8YqdZcQ/nBhtreePdX9pZhlNeBDFiLzAfhm7zmyLLhaTOtTBkwCoilc2XazcASFky+Cvy1oMkVeN/K6CuGDsVvGwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFH3ZYvZskV07lrAXICI6I9lAazpJMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwPgYDVR0gBDcwNTAzBgZngQwBBAEwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQDUFsZWQJeNmFx5Qvr0gQvPwUc0VgRHThr0M69gIzTIf5NzDsKiCr/V6q4u9Se8kJrHxp4lFraH5ncW8RQSEJTgsR+MpBfWMLx7GO6LmekcWiwwEe7KW7sCt4Pw0Zz9wysdm2w2RRCKo+YlMLbOh5ts+FmV2g3xSyCZoI0olBD1ja8FWdPCVA9qM6Cp+WC9qi8nOYMPEQGz8m9/HZ7Xtd6iVYEUnlf9moeO2WEf1EOojJzdNwN43gkGX3Wo47pXTTmRnDucraSg9nIz9orvc2Xhq9PWu2fM3n3Z/CfWEtfSBfJ5TBXY6JXaVaQb3y/fie3L71bDdiQtbuxINeee0p9Ctya3CJHTO+K1BhFHYjaSmJDwInh4mNr9z28Hs6IVS5Pl+eew9IX+3a++X2s+qiGIsauiR9DvvcpwDcwiQdxTnsepui5hsPZGgSjsY3sqXt+8Jos4uhqqg6tIdywPPjZFVBzkiqBm38JQUHaKeAU1pe/t7V4JyYYtOYSTHuYXRLg8VdmrVNmt0jlLCvtYYqNTJQy0sVg3WEogRC2Hp3haXOBPizTq6mdeeYDYU65ADQfgq5P6reuZ76AWCuoKVsaVUT2Bm+I1p46kVj5pIvjcCLXNX/vMHH62tn20eiukFpDwUVEDwDkX4pGxI2XjIEOjXhqMK8OYfSmO1GWglXWqMg=="
      },
      {
        "signer_name": "Ivanti, Inc.",
        "certificate_thumbprint": "85651505F0D1CC0BA24040F3F8913D94AF316100",
        "tbs_sha256": "B09E0A6BFE645556A89F3B8703C4B496699C3DE4A44819DDC265C2B95672C928",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIHWTCCBUGgAwIBAgIQClmuDXbqs7Wxt3Xp7Gmn8jANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIzMDkyNTAwMDAwMFoXDTI2MDQyOTIzNTk1OVowYTELMAkGA1UEBhMCVVMxDTALBgNVBAgTBFV0YWgxFTATBgNVBAcTDFNvdXRoIEpvcmRhbjEVMBMGA1UEChMMSXZhbnRpLCBJbmMuMRUwEwYDVQQDEwxJdmFudGksIEluYy4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQD2UqOokl1oqbMAuoz6sDsKiYCCR14fD4u7eGl5mqKzpaWvst0N/BCd8Ba1RuHFna3KQRU9NSXvHgEl7oezXcusnAd7HbUONQf8xE9Xj5lmumvSiVdi2MtgZojEaoMNhwTIdCt63Bv4ps0716+uTBVibvoGX1U5s1pMFLQzQkfT35Ubj85JadcPZBU/n0uU4gxgjxnuNuAAXuhy2CRwzU+kci+C5WaGYzPGJ1FTXTy4x63I7bsXdsCDkhXm5/AoesZWAobz8sXiCbQU/X4PjUBJhF9FY2B9pp7+U65TAWL4tbiQ+hwBI8XCLf+kkwYC0OVRj9DUoV/c97qr2ddhNBfkIKiZzdhp7hqg3e7CYrAjNfi0Qy1PlbbLCO5NpIWw5PtO4lfio1aDnW+wXVsQK1oI/1u2CPyuXGtuNTu7+cygtEFtlesdgCuWwNKaPYgnR6BoYxp7PcRNh0ZjSCTUaYeieWJee3eSOILRXw9X1B0PiugBedlvGusnAaBdv/3+DkIk9zBzknwXG9DQYxnjLRC96dBh5+gjldbcZdXy2bQLi1d0BdQzippl99Bw2dBOn9eyZ1DKRFAryAkiC/wZBvstIueDh1FNJ+1qnC1ig7wFpquMf73blkFjpXjibCqTwJ2zZjoQyrB+9fu254pzo0rWCGFJYqjDCgYVZvQiIUxxPwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFH1RU+aUcJFCY9aNzT4P6GdDu7D3MD4GA1UdIAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQA868Zf8PKoCDNWF34RdZo0KIpBp/PMyZshFlupt3YEmcXYcDB5SuvXZAWelOb9BuDJE9Caf0VcgotssJK+cOXncjBpf1C77qFkux7brrF9KxO2Du/YS1i1j/lXEiM13PBL9SMWqiDtY3b+6znX07anPEhX4WM5CrqJjEhQtJWD6CE2oLNoxRRYokpP2op5nTfaaBIQDVXiA/mA9Bcu1O8c76n4tf/mhWJHKbJqeEqqhMQYWXqtkrbnzg1x+X9+sFNqS7SfUGimE9+n+tByKDDRZBeay5qdfAuc2+q1zxVVTe+Y5vsQ+C6smAamcHDyDz5k2IWUFvN0yq8k/Zsr/1kO42r7ZU66Smvt3WE66KGlaKCrU2lbv7Iwz3OOBX5n4lKVO2PpcVC5jIynrmvQRD4Jl1Lyxw+psbvBy2J3eyVPHGonU5IagkOb3WbqEwu6xAt5vK51AxZLzzoDNrKXx/oR4rd6lSL1qcylW8V5tzmOaSQBQGh9Q2ODc7sIHn2nUPgrY3iHiE0Ii/POwLnYhilUpmT0b1zcBeU95ybZQRLR8899gwwO8JhX0t/Ls7xuRUSXGARALrjydrEGyZFeUJwjwxV7GS61IXeOVevf5hjIiWK6cUJ7GzxRVfGzV93xvxbbW7WSLZBt8dyWZV4xiprRMJQS1KauaqNB3spKZniqMg=="
      }
    ]
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "DlgServer",
        "sha256": "629D602ADEE0B644C1742E3B2728B929FDD8E0B17194CB4FAE6F26BCE5B68D79",
        "sha1": "6773B4BB4082B38F760E980639AE3C67B9C762B4"
      }
    ],
    "page": [
      {
        "file_name": "DlgServer",
        "sha256": "93D38F683E250A6563BF7B1A28A22EABD5D18635F2A0A44D3F6082B7967A2ADD",
        "sha1": "08AF57A46D0843BE00C91227F6FA53EEC0D1F8CB"
      }
    ]
  }
}