{
  "Name": "N-Able Advanced Monitoring Agent",
  "Category": "RMM",
  "Description": "N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://www.n-able.com/features/advanced-monitoring-agent",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "BASupSrvc.exe",
      "winagent.exe",
      "BASupApp.exe",
      "BASupTSHelper.exe",
      "Agent_*_RW.exe",
      "BASEClient.exe",
      "BASupSrvcCnfg.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "beanywhere.com",
          "*.beanywhere.com",
          "systemmonitor.co.uk",
          "*.system-monitor.com",
          "cloudbackup.management",
          "*.systemmonitor.co.uk",
          "n-able.com",
          "systemmonitor.us",
          "*.systemmonitor.eu.com",
          "*.logicnow.com",
          "*.swi-tc.com",
          "*.remote.management",
          "systemmonitor.us.cdn.cloudflare.net",
          "*.cloudbackup.management",
          "remote.management",
          "logicnow.com",
          "system-monitor.com",
          "*.systemmonitor.us",
          "systemmonitor.eu.com",
          "*.n-able.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/n-able_advanced_monitoring_agent_network_sigma.yml",
      "Description": "Detects potential network activity of N-Able Advanced Monitoring Agent RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/n-able_advanced_monitoring_agent_processes_sigma.yml",
      "Description": "Detects potential processes activity of N-Able Advanced Monitoring Agent RMM tool"
    }
  ],
  "References": [
    "https://documentation.n-able.com/takecontrol/troubleshooting/Content/kb/Take-Control-Standalone-Ports-and-Domains-Firewall-and-AV-Exclusions.htm"
  ],
  "Acknowledgement": []
}