{
  "Name": "Quest KACE Agent (formerly Dell KACE)",
  "Category": "RMM",
  "Description": "Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://www.quest.com/kace/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "konea.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "*.kace.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/quest_kace_agent__formerly_dell_kace__network_sigma.yml",
      "Description": "Detects potential network activity of Quest KACE Agent (formerly Dell KACE) RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/quest_kace_agent__formerly_dell_kace__processes_sigma.yml",
      "Description": "Detects potential processes activity of Quest KACE Agent (formerly Dell KACE) RMM tool"
    }
  ],
  "References": [
    "https://support.quest.com/kb/4211365/which-network-ports-and-urls-are-required-for-the-kace-sma-appliance-to-function"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [],
    "company_names": [],
    "signer_names": [
      "Quest Software Inc."
    ],
    "certificates": [
      {
        "signer_name": "Quest Software Inc.",
        "certificate_thumbprint": "41D7B56D7E8A181A954AA35A3A0FDF178FAAE01A",
        "tbs_sha256": "C7638A5AF56C9F4AE902251705B2E370E209E7A9218605628995AD73469E0F53",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIFDjCCA/agAwIBAgIQEfKQonSQc9jEZMzfkxO3rTANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDEjMCEGA1UEAxMaQ09NT0RPIFJTQSBDb2RlIFNpZ25pbmcgQ0EwHhcNMjEwNTE5MDAwMDAwWhcNMjQwNTE4MjM1OTU5WjB0MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEUMBIGA1UEBwwLQWxpc28gVmllam8xHDAaBgNVBAoME1F1ZXN0IFNvZnR3YXJlIEluYy4xHDAaBgNVBAMME1F1ZXN0IFNvZnR3YXJlIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0l6j3a7y55QHCxXRddxsu0/kxDHpEQNa7TJpJQOs/Q8cgc/Qvss1j00xc5Sxrt6YBm1jNQg7Q06ihCls6hvU4IxxzeuDLwhGjF0M4gj4pQnZ7jcoHD7iak2RvRWVl+6bn4n6q/W0mYv9qsIvpYgBjIAz3fyYrSNDvjCUK4g7u9CfnaY2Vgfjj6pWn/G5pS/svptnZeCgpuFGyPIK36Civ26q6fvCoY+3EP/TZGhVM655t5t5AKM+gtaSHtbwOXTvFcywKFTMJV0tzmi7kPUnV9w+7xr3m87uTcrQjRq6Mw8YMQ3FkzusNbFRTOs7vw1X2OeMoz5OHrBQEQjbeuEQXAgMBAAGjggGRMIIBjTAfBgNVHSMEGDAWgBQpkWD/ik366/mmarjP+eZLvUnOEjAdBgNVHQ4EFgQUBgvRF5oqO6cm0XdELhdZ1w3qiTAwDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEQYJYIZIAYb4QgEBBAQDAgQQMEoGA1UdIARDMEEwNQYMKwYBBAGyMQECAQMCMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2VjdGlnby5jb20vQ1BTMAgGBmeBDAEEATBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9DT01PRE9SU0FDb2RlU2lnbmluZ0NBLmNybDB0BggrBgEFBQcBAQRoMGYwPgYIKwYBBQUHMAKGMmh0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9ET1JTQUNvZGVTaWduaW5nQ0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wDQYJKoZIhvcNAQELBQADggEBABvAXlNe+h4e8jWN9JG37CAUhS7maC1C3SQN7DfpVuYBVmcbOAd81jLixoU8HbbwVhXgLxrgO8kdPEz8MiJtACAcfTbqgghTHyXmDi69NwfPzmQySDcvvjsW88IDJmYi/pT6JQQCUCeQ09Yb/8DSdpmwdg31CuKwHGe6aB6T4pOdJ4u+Ry4DLTf82m3BFUG1oLR++7fiOK9X8nsmrM8NsTXvxbFvJm3wGeFWJbZcOwkaXkFmhU7OVukvdR64saXcx7O9MUtxQ01hT3tC3R2pxy5ZzR5gc5WUJ/jjzqBGr6ZtepAhN1pUBicLRGd8EhCwO+CvCEDQWlRzlC2+0eTAoGM="
      },
      {
        "signer_name": "Quest Software Inc.",
        "certificate_thumbprint": "B7DF1291422B3186EE44BFF040931D8788DB63E6",
        "certificate_der_base64": "MIIGSDCCBLCgAwIBAgIRAOSb9emaya2tyNrjhziVJh4wDQYJKoZIhvcNAQEMBQAwVDELMAkGA1UEBhMCR0IxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDErMCkGA1UEAxMiU2VjdGlnbyBQdWJsaWMgQ29kZSBTaWduaW5nIENBIFIzNjAeFw0yMzA0MTcwMDAwMDBaFw0yNjA0MTYyMzU5NTlaMF4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRwwGgYDVQQKDBNRdWVzdCBTb2Z0d2FyZSBJbmMuMRwwGgYDVQQDDBNRdWVzdCBTb2Z0d2FyZSBJbmMuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1qSuxiOmKkO8eeQsFZ4wCVdW6UpZPvFCocFas+tukHi8wRHk5N6MjlZhhKi7d/xyqE2ScplntssYwvfOIXiHRd2f/8scgH1+24VSY7sBWQZ7m436EL3yHbl/FlgjeYadFG8ieZyrzBZ37eDg/9QDBL+TpXKA2k+B0oeSpK8pvg72WkJAscDXwb8xgh2u/BRLCJ3h21VkMpQGbkjSy4obf7308JI26ghGDWDswLOKRJEK241NHouz8KX9boZLMq4Ld9J6z04ikpyOJt8jSMSsUovJqtsSSjqG0SCJuj1yj47HQOdCKEh0cVhgcA5qde+VfML5ozMUU/49Cm6t6yjcch13xZfMT0QoWxXUOVpoRLzK+DjtVEjxjmgyaP+MBygcRsbPVnwsK0v0Vl4kv3sHKYsAyDWSo8By840bddUySv4EfBgOqXhIgbBI5jaRgtC1F2JvbyxRWvzO/iMbO6NDCR6nHm+NNecaIq7Y2WcbsXwUczmnwnlfbt6yK8w2Cp/GFqVTLVtWAEedd7LbyHIzvOq379YfoGaT36XUidfb/A2I2lkwEnhewa/uiJuX056VtKC2zy2WvH6xdLEmT818ExFJ8e4uuhd4CgE0jZ7EiYi2K5ELOwzemrS3G2zSrz2Hzw3g1+1nqRUVa156wzjdiPXyQmqm7g952+FuUxuqHpECAwEAAaOCAYkwggGFMB8GA1UdIwQYMBaAFA8qyyCHKLjsb0iuK1SmKaoXpM0MMB0GA1UdDgQWBBSjPqOFNjp92OUXa6Pg+ecTScxjkzAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggrBgEFBQcDAzBKBgNVHSAEQzBBMDUGDCsGAQQBsjEBAgEDAjAlMCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzAIBgZngQwBBAEwSQYDVR0fBEIwQDA+oDygOoY4aHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUHVibGljQ29kZVNpZ25pbmdDQVIzNi5jcmwweQYIKwYBBQUHAQEEbTBrMEQGCCsGAQUFBzAChjhodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3RpZ29QdWJsaWNDb2RlU2lnbmluZ0NBUjM2LmNydDAjBggrBgEFBQcwAYYXaHR0cDovL29jc3Auc2VjdGlnby5jb20wDQYJKoZIhvcNAQEMBQADggGBACmWJXb+vE5D9meFUSz4f1Uo9/63op2xT06EBi3TnTKJiy5MjM3XwPhcgpWekGUBQJGDKnsXaAVlluXwk8Bl3ydGqCBuD/BKh5Ch+u1ZJE8niHWXDSqxRrBIUeq8/j5vdZPCcMmDwn5TZyJUvcvdYoNFUCuxC/EB1EDSyBLgJUBztsfQe8AsIk2+NyQHqef7DKC543xGvLSDwq+79ewzGbOXDWNC360/pljN8bkvxNtki++ZwwV7BfHmo1dXE3sxvOP3lqUSZ0NMFWkrNhCq8yoPkyumGAbviKPZqra8bLr9maSMQ7oAAEErfVvi3kB/pRzgHHpsa/NjxvN5XDPct2w1gZelulpohTKi7E2fv4OC4uicpYmHU0NzVmbmz0Dg3b6ExVvYJPesHW7pyHIr1CQqjCaN8Q/Rw4Xe7+NrA/DI+tHcmhS0svLCie4cLTS58B7myxbAS+fbZtkjjnOH/vWmSDDBYpvnGi0DLzHAt7XzFt6kKlJsw5hl2Npwe79DOg==",
        "src_file_sha256": "850a4c24055afc7d293232f250f8ec7cc4bb6971f2fe159512427196e96720eb",
        "src_file_path": "downloaded_files/quest_kace_agent_(formerly_dell_kace)/850a4c24055afc7d293232f250f8ec7cc4bb6971f2fe159512427196e96720eb",
        "src_file_company": "Quest Software Inc."
      }
    ]
  }
}