{
  "Name": "Pocket Controller (Soti Xsight)",
  "Category": "RMM",
  "Description": "Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://soti.net/products/soti-xsight/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [
      "Windows"
    ],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "pocketcontroller.exe",
      "wysebrowser.exe",
      "XSightService.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "soti.net",
          "*.soti.net"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/pocket_controller__soti_xsight__network_sigma.yml",
      "Description": "Detects potential network activity of Pocket Controller (Soti Xsight) RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/pocket_controller__soti_xsight__processes_sigma.yml",
      "Description": "Detects potential processes activity of Pocket Controller (Soti Xsight) RMM tool"
    }
  ],
  "References": [
    "https://pulse.soti.net/support/soti-xsight/help/"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [
      "pcpro602setup.exe",
      "pocket controller",
      "pocket controller - professional",
      "pocket controller professional",
      "pocketcontroller.exe",
      "wysebrowser.exe",
      "xsightservice.core.dll",
      "xsightservice.dll",
      "xsightservice.exe",
      "xsightservice.linux.dll",
      "xsightservice.windows.dll"
    ],
    "company_names": [],
    "signer_names": [
      "SOTI Inc.",
      "Wyse Technology Inc"
    ],
    "certificates": [
      {
        "signer_name": "SOTI Inc.",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "",
        "tbs_sha1": "326E0C36EE3DF3DE0FB7183A30ED6682254AB2E5"
      },
      {
        "signer_name": "SOTI Inc.",
        "certificate_thumbprint": "N/A",
        "tbs_sha256": "",
        "tbs_sha1": "",
        "tbs_sha384": "4265D6A8BFDDD5383B9A45AB04EF925DCCA723FE04AAF792B74A83CD6E817CEF125F1A388E855837D7E1DBE33733A820"
      },
      {
        "signer_name": "SOTI Inc.",
        "issuer": "CN=VeriSign Class 3 Code Signing 2010 CA",
        "certificate_thumbprint": "7A3E4DECEE064889D6F6EC54C8DBAEE092ACB26E",
        "tbs_sha256": "AFBA691FEB4E4205B37C8929E5D10C40493F9C32D8C4FEF35C02C942BE6AE2AC",
        "tbs_sha1": "326E0C36EE3DF3DE0FB7183A30ED6682254AB2E5",
        "valid_from": "2011-02-24T00:00:00+00:00",
        "valid_to": "2012-02-24T23:59:59+00:00",
        "certificate_der_base64": "MIIFWjCCBEKgAwIBAgIQPeLsNVa1VJQJuS+PWl7dTDANBgkqhkiG9w0BAQUFADCBtDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEuMCwGA1UEAxMlVmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAxMCBDQTAeFw0xMTAyMjQwMDAwMDBaFw0xMjAyMjQyMzU5NTlaMIGdMQswCQYDVQQGEwJDQTEQMA4GA1UECBMHT250YXJpbzEUMBIGA1UEBxMLTWlzc2lzc2F1Z2ExEjAQBgNVBAoUCVNPVEkgSW5jLjE+MDwGA1UECxM1RGlnaXRhbCBJRCBDbGFzcyAzIC0gTWljcm9zb2Z0IFNvZnR3YXJlIFZhbGlkYXRpb24gdjIxEjAQBgNVBAMUCVNPVEkgSW5jLjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIDuS892Xu2pNtHTcjWKywWw0XAcbiFUcge8tvR1TkNpgYFThKRaONszjaIY2VYPlrDIw9sE/k8BtjoI2gjDAd91gPiPrbgrejgrhWdNZbXR84gbMXSWXWCYb8Ikgdg4ymrbDOnZPfn+0B/3ozV5oOpjvn8WmwyXiOdvEmZpeFNDUhg5Mpzk17lvqFsxOfOly5XfYdy9IZH6zg5cuYfBcFJabRTxo7tjEjRMKGF0DQBrrfh1Kip0EAqyKmVv1t4KuknVw/UCfWlRty37oe+jRAkCz8G5FU16qft7Vq3gi9LkMkd4P2DxizTeb/SxiAvSeyy4/UIolkWO4Qbi+sXNbXECAwEAAaOCAXswggF3MAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQDAgeAMEAGA1UdHwQ5MDcwNaAzoDGGL2h0dHA6Ly9jc2MzLTIwMTAtY3JsLnZlcmlzaWduLmNvbS9DU0MzLTIwMTAuY3JsMEQGA1UdIAQ9MDswOQYLYIZIAYb4RQEHFwMwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYTATBgNVHSUEDDAKBggrBgEFBQcDAzBxBggrBgEFBQcBAQRlMGMwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTA7BggrBgEFBQcwAoYvaHR0cDovL2NzYzMtMjAxMC1haWEudmVyaXNpZ24uY29tL0NTQzMtMjAxMC5jZXIwHwYDVR0jBBgwFoAUz5mp6nsm9EvJjo/X8AUm7+PSp50wEQYJYIZIAYb4QgEBBAQDAgQQMBYGCisGAQQBgjcCARsECDAGAQEAAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBwPblnl4oj8EFmONplf6IzrlgD4AB9m7VbCl6zN6AoqUVTBbZ3m0kurhslGUsmwv+rMG4SBHrPBG3wIO8qvHcsxZYIKwfzlHfzQGdYEiN9o/1MI+n0XpP5yuIY/Wq/xyShCnd0CDADBRMC8COR/IEeJSLL7Wny5UgbDFyonU8MXNQDRlt6ArqQDynkqsnPIyeBC8ncmzXU8NjS9WGswJg72mwVsbSiR5w13Fs3ID6LB25/9Mw8pKdbto6Xk8oloWAAhk1p1+fPs7YVVEDojVvEXKjAwpZjiHDcVcoqiZZufFoUCZcRgBrUHuD8Dy6bV1zJ7Fni9cpLoyJNJpDMxkxg"
      },
      {
        "signer_name": "SOTI Inc.",
        "issuer": "CN=Sectigo Public Code Signing CA R36",
        "certificate_thumbprint": "EBABD13769964EA7279533174328F28BB711CB03",
        "tbs_sha256": "20442C9DC0B4BB786D51EC3B9246AC870FB78FA32759CDC539CF05AA63FC6911",
        "tbs_sha1": "FCFE638120C602F83FE960E11B80ED837461F175",
        "valid_from": "2024-07-23T00:00:00+00:00",
        "valid_to": "2026-07-23T23:59:59+00:00",
        "certificate_der_base64": "MIIGVjCCBL6gAwIBAgIRAOC564rZlEms0wKFspYh4YUwDQYJKoZIhvcNAQEMBQAwVDELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDErMCkGA1UEAxMiU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIFIzNjAeFw0yNDA3MjMwMDAwMDBaFw0yNjA3MjMyMzU5NTlaMEcxCzAJBgNVBAYTAkNBMRAwDgYDVQQIDAdPbnRhcmlvMRIwEAYDVQQKDAlTT1RJIEluYy4xEjAQBgNVBAMMCVNPVEkgSW5jLjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKZ4olXEdSGaPV0sv4FujPSqmH7gBmXf/5rK4YHKamh/3T9hI5kYA86bpSrjVkRKJuMFJs4q/ACGEagKvv8u/CC+wUV4RcOsiHu7BF+tbKOucAYuTXlmP1bH0GbalOJKFOpcDpoFnnCy6uaMCkd+6b5oDRbnCyxjvQS6JDYrfSaSCu73DgUWgT0zg7vx1iSj73ACwNdyDLXa4nPOcsQrfINfysbeUHe4jg1SExN2l83wBIvyJX45neSp/5Uyr6hr+fgQ5SCq/HAf/lsdchNjQioKlzhBsyWDh0CxfokV0PSWf2ub4D9dPD6eM2BcwSDz5bAn4A53ZiDmJmPnO5DUolcdcajW47WmOvQd58FOuLRBpF1dkN/dqceVcR8WKnZ0eTG7HEZIi0NonTxAyOD/OlHdluPdXpvzFaiSQ09DdG42ilDvpkKJod/Jh8mDM0SfcrYnEteYvBwUEJSXwVkyn5KRVr7cRbHGuYyHkZQ4NzOIdGjOBhKHqje+Y4azoB8qdUQ4AUjNtxVBRI+lWHh5FID4gClhEgBDJ3hZYzJFB8DosstZYcM0g4ZHrzUpNDYM8rymb/FiNPNvTO6FZniH3Gki50WlDc7rlSTu/8jCvOyugxAczdCN3/v/nsJjDu9EjhVCTps/JvK7IJm+muveLGvegagm041yimKwSIne5ZQlAgMBAAGjggGuMIIBqjAfBgNVHSMEGDAWgBQPKssghyi47G9IritUpimqF6TNDDAdBgNVHQ4EFgQUO+DW1h67BQldvilGJOlo1Mqe5QcwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwSgYDVR0gBEMwQTA1BgwrBgEEAbIxAQIBAwIwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwCAYGZ4EMAQQBMEkGA1UdHwRCMEAwPqA8oDqGOGh0dHA6Ly9jcmwuc2VjdGlnby5jb20vU2VjdGlnb1B1YmxpY0NvZGVTaWduaW5nQ0FSMzYuY3JsMHkGCCsGAQUFBwEBBG0wazBEBggrBgEFBQcwAoY4aHR0cDovL2NydC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQVIzNi5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNlY3RpZ28uY29tMCMGA1UdEQQcMBqBGGNoYW5kbGVyLnJhY2luZUBzb3RpLm5ldDANBgkqhkiG9w0BAQwFAAOCAYEAU50eFELIpAIILGTHQ6sl1CTblNV7L0dUxGVoS7GFERZJ9Tb86RVRK847cxsbqTgqOKrFfuXFg8TQBMQSprWqBSl/fLNbnpJYcwD2NMQM+qv0KBC0WVTzHZ7d690n9Jg+PIPZD5aDQKet+xwYXYu+7b3kgmEk6et1mE3hDXLaFcT9D8MBnQSgINl+QdBBSn4irhra9CXFBZDXtupm+qZvU7Sripjc09e0D1ArGxLbdT+ofNnNlfpxDsDtaKmk8clPeNblRg4mAVcMuoLycSlu3zJG3P/lQse+M6ra6qfvMshnkdacxg38NQ1wu46VB/BzeCocu36dq8ieE/3IZGys3I0iodsO3XpJ90FT0P9Y4dq9z6zCkkt0M/6zsU2Tc6MIyc20oBz4Ho8V10JGd+ajnKFZUADtAY6tKdS9vKo5LomWj9qm/gdAveLkruv7l8KcZqmzKg/xB/lmkWV2+XLnVK9FW9HpJYX/FEQPxishQDsaGuFWoozRAEuoaQt8jJA/"
      },
      {
        "signer_name": "Wyse Technology Inc",
        "issuer": "CN=VeriSign Class 3 Code Signing 2010 CA",
        "certificate_thumbprint": "537AE8B3453C27FE7C5DD562ECF90CA76551E95C",
        "tbs_sha256": "64AC7AE69C452B5F6ACF71EA0485E36D88A868DD187C196AA2D140EA3124A0F6",
        "tbs_sha1": "5249EAF595CF905C688A7CA49CD9B49E7DD9E4E1",
        "valid_from": "2012-09-17T00:00:00+00:00",
        "valid_to": "2013-09-17T23:59:59+00:00",
        "certificate_der_base64": "MIIFjDCCBHSgAwIBAgIQB3HyQPsosUPqq38SQJ2VMjANBgkqhkiG9w0BAQUFADCBtDELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykxMDEuMCwGA1UEAxMlVmVyaVNpZ24gQ2xhc3MgMyBDb2RlIFNpZ25pbmcgMjAxMCBDQTAeFw0xMjA5MTcwMDAwMDBaFw0xMzA5MTcyMzU5NTlaMIHPMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTERMA8GA1UEBxMIU2FuIEpvc2UxHDAaBgNVBAoUE1d5c2UgVGVjaG5vbG9neSBJbmMxHDAaBgNVBAsUE1d5c2UgVGVjaG5vbG9neSBJbmMxPjA8BgNVBAsTNURpZ2l0YWwgSUQgQ2xhc3MgMyAtIE1pY3Jvc29mdCBTb2Z0d2FyZSBWYWxpZGF0aW9uIHYyMRwwGgYDVQQDFBNXeXNlIFRlY2hub2xvZ3kgSW5jMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp7yS8F/L95u4Hx5DEeQ6Elf1hTg/U2XQkzlWdeMBEDwGztZxoaRs+xVAdUzDmdfZTS/ZrR2k/QrRFDS2yjmQc2JUFxh8y4kQ5rT662qf95VKw0Q7iz/eLwnb60J1uhc38dZ68gcgenb8iBRubvBP0JLCVsxhzr6kEqPHuHc9MDgUWsu9ti0eVUx0hFHA7J3jj/Ize9HVdmEr2wMGRphdf0EXnrBJ0E1C90GvmqYQ5CGPugnIu4hgSwfZEoe/XiqpsiriLT6P/+sNrB+Cvsu1JLh+LZcrDjh4cHRuUoBJQoWQnmLpzwWsBJOxgyJMsvqbVOz+PQe12X56NHnWUGP0KQIDAQABo4IBezCCAXcwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCB4AwQAYDVR0fBDkwNzA1oDOgMYYvaHR0cDovL2NzYzMtMjAxMC1jcmwudmVyaXNpZ24uY29tL0NTQzMtMjAxMC5jcmwwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcXAzAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMBMGA1UdJQQMMAoGCCsGAQUFBwMDMHEGCCsGAQUFBwEBBGUwYzAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AudmVyaXNpZ24uY29tMDsGCCsGAQUFBzAChi9odHRwOi8vY3NjMy0yMDEwLWFpYS52ZXJpc2lnbi5jb20vQ1NDMy0yMDEwLmNlcjAfBgNVHSMEGDAWgBTPmanqeyb0S8mOj9fwBSbv49KnnTARBglghkgBhvhCAQEEBAMCBBAwFgYKKwYBBAGCNwIBGwQIMAYBAQABAf8wDQYJKoZIhvcNAQEFBQADggEBAE3fgd8wSlrAV0g9+up4/oGCsBskdMy8Tq9P803JDlYnK3bUbXezB6T4qCSai08UfGlo8FdHIl/zmprBRoi5KGZ5VgO84C4Y9shPBiQSKEbVJln/wCRAiQb33nR/KTvJ/kKDYwAVZivcQZZ90FUTzQ8kcTX+wZUvW7ZJWkmXhMiCIVwrJjVJjlUq72+HWgns4Wa/tnnhnhCx5WyN0ujZuMcYccDZGiL6Eae+me24QkmKq4xJcy+PQ+dQmFJu1vcjtgFaZt7s50CDpx38CpJZSAPgFe1wZ3X/tmxJrJXYgGowEaoGfRexT/xzcNXyU47d4TuIeqWUPFgK/zzaEjAZ130="
      }
    ]
  },
  "FileHashes": {
    "authenticode": [
      {
        "file_name": "Pocket Controller - Professional",
        "sha256": "C8C95F39CBD230B362337428F9D8FF5FD6B0FA9AFC0F9BBA590DC18F33258998",
        "sha1": "5AB1D8EA968152256B067C3D8697272B9CEC9F56"
      },
      {
        "file_name": "PocketController.exe",
        "sha256": "B8E99BFAF205C97AF579AD6B73C05FDC1EA08B7A56C51C6964A7697CAD064400",
        "sha1": "653831627348E40F9E5AF084D047560621896179"
      },
      {
        "file_name": "XSightService.dll",
        "sha256": "36ABF6CBDB0CC0811AB9DCA56B5E7A28FB67CFCF9995EC961905D8EC2D62EE8A",
        "sha1": "85580901DB83608717DF082D3ADB93438641799B"
      },
      {
        "file_name": "Pocket Controller Professional",
        "sha256": "96E0074337F819EBC5DD8321087E196577F6114A1071CF53C5D112BB8714EC6C",
        "sha1": "44231844BA9E0DBD13286002D781318DEE8AB1E5"
      },
      {
        "file_name": "Pocket Controller",
        "sha256": "C7FDC274CDDC5B15F1F3E711B0357FE4BA0B44671172E245C4EDFDECF1C740A9",
        "sha1": "7928FAF909D49128E98E96880EE7D656679A9F00"
      },
      {
        "file_name": "XSightService.Core.dll",
        "sha256": "D5047115F94567CE14743272131AC9AD7C604680A3B9FD2182516E8B06B065DF",
        "sha1": "D87494923B5114F4E1797EB9F0FE953627565E2C"
      },
      {
        "file_name": "XSightService.Windows.dll",
        "sha256": "31B3EF905B727EDAD232595471DE256587BBFE57D4608A09C8DEBDDF21BDE890",
        "sha1": "D979A4ABBAC552D64E32BD36737AC8E6798A87F3"
      },
      {
        "file_name": "PCPro602Setup.exe",
        "sha256": "81638DDB4550AEB1161B2D24D30E41A505E651DC25A55E4A62F0AC32A510CCFA",
        "sha1": "1334B034565DE833410FD50DC14E13FE2215F576"
      },
      {
        "file_name": "Pocket Controller - Professional",
        "sha256": "ECF236477A707C45292A049EF3FBB6BE4B25C691132A6AB9CE0AA95F043ADB52",
        "sha1": "65970C526943AB2CBD0BB01DA31C1C8ACAC77ADC"
      },
      {
        "file_name": "XSightService.Linux.dll",
        "sha256": "4747545FC0506731BB7F7A2154A69CDE4EE35C2FFEA3407A91EEA6FC687728AD",
        "sha1": "8C51B1DA012A9E23D6AF3AF86EEFD6F4A752A692"
      },
      {
        "file_name": "PocketController.exe",
        "sha256": "A121581AD6F5C8DC176AF0FB1B9FF69A12786D305902DCCA29B7F765767E0785",
        "sha1": "D128E371B03E5E7C0415D537A5C6CF659D15030C"
      }
    ],
    "page": [
      {
        "file_name": "Pocket Controller - Professional",
        "sha256": "9C499645FB1A3E22BD638F432E0C3263C09A9544C81F2EB21EA13894C9084E4E",
        "sha1": "81D649FA0EBF918EA1B73DC45C1115CFFB4BD70B"
      },
      {
        "file_name": "PocketController.exe",
        "sha256": "D4784E9C2890D87B5796B84888BAE6732FCF974E8681B3FF31C09D651CD2BBC5",
        "sha1": "EEA19CFDD2200CF1ECBF73FCC9BFEF7C1DB388E3"
      },
      {
        "file_name": "XSightService.dll",
        "sha256": "9C29FE63C81DD70D2C7978C92634336F11F96806877726108F966E3C8B6367DC",
        "sha1": "D7BFE918146B3626C3474EEC60BD9EAD8909167D"
      },
      {
        "file_name": "Pocket Controller Professional",
        "sha256": "19676D30C7AF609F69FDB0071E7707F68F5CF21102F483FADA1785C721ABFF9E",
        "sha1": "D6BD6EF154F2A7E065415D2B61FCD1EC15D87BFF"
      },
      {
        "file_name": "Pocket Controller",
        "sha256": "C7C6FBDD502FF945F1CD104F0F8F4280769CA532095850E88BC5A523BE6E760E",
        "sha1": "CF1AB8172D8909774C70CB25C96BE78AB8682A02"
      },
      {
        "file_name": "XSightService.Core.dll",
        "sha256": "0175EF28328517DC999022D2A1D97B6F7D4B9B40A0502B1A97527A638E5A3F88",
        "sha1": "A3C8A160811DBD929958F0400426F838340A3FB7"
      },
      {
        "file_name": "XSightService.Windows.dll",
        "sha256": "193D06828C6E920E7EDD95170B77E0BC696972C6BDD839C5C51E5568188D1F0F",
        "sha1": "8EBA4A7E030690F77CAA3891801673D76B541CBF"
      },
      {
        "file_name": "PCPro602Setup.exe",
        "sha256": "F5285668D1B167242BFD832FDACF0CF461FEC07AE68F90D2AB521B00A98CD1F5",
        "sha1": "D5E51B1B4CD54F75B5E18ADD5D35165710CC79A8"
      },
      {
        "file_name": "Pocket Controller - Professional",
        "sha256": "E9ECEC8A3C424D5890F1AF729A7AEC67F9A395C09A2AED5295FD646C8CCA286B",
        "sha1": "E116F6FF705BF8151E03955A327E4B7EF7817CC8"
      },
      {
        "file_name": "XSightService.Linux.dll",
        "sha256": "E865EC62D5AABFC1F3D3BB2E20F62163CBA74CBE2C2C0661F84B8DB45D4E85A2",
        "sha1": "C1E1E2EEF8DB7A6FC26CB1A870D230A863655DA8"
      },
      {
        "file_name": "PocketController.exe",
        "sha256": "A1C74233EF3BE253A8D9081957CA403DE007374CD217DF6F1446F2DDCE61492D",
        "sha1": "D48515A5A75C696F834C39EFB452E4BFB8A2D122"
      }
    ]
  }
}