{
  "Name": "RES Automation Manager",
  "Category": "RMM",
  "Description": "RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://www.ivanti.com/company/history/res-software",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "wisshell*.exe",
      "wmc.exe",
      "wmc_deployer.exe",
      "wmcsvc.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "user_managed",
          "ivanti.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/res_automation_manager_network_sigma.yml",
      "Description": "Detects potential network activity of RES Automation Manager RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/res_automation_manager_processes_sigma.yml",
      "Description": "Detects potential processes activity of RES Automation Manager RMM tool"
    }
  ],
  "References": [
    "https://forums.ivanti.com/s/article/INFO-Which-ports-does-Ivanti-Automation-use?language=en_US&ui-force-components-controllers-recordGlobalValueProvider.RecordGvp.getRecord=1"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Ivanti, Inc.",
        "certificate_thumbprint": "B310DCA4816C8E3E41E6C72BBB67A255AD8E0363",
        "certificate_der_base64": "MIIHWTCCBUGgAwIBAgIQBsyN0tcIuQcyg45nl3swfzANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIzMDMyMzAwMDAwMFoXDTI2MDQyOTIzNTk1OVowYTELMAkGA1UEBhMCVVMxDTALBgNVBAgTBFV0YWgxFTATBgNVBAcTDFNvdXRoIEpvcmRhbjEVMBMGA1UEChMMSXZhbnRpLCBJbmMuMRUwEwYDVQQDEwxJdmFudGksIEluYy4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDJ3RSNQX//5l85k0tbY0veBq3kRuTO5TKZgJC00IR0Y3xMpPj4HzM32fPOzsV6ooV6AcKM/3X20ENhHE2Cj/FB3v+ptWOniYRRxtJhaRZlRxs7saEK+xirr+kB+2vtYpfsgerArxOb19exJ/OSnzYFbMzsoZcKhm0IEcik/qkkDttnmD1KaR8wSxZi434bwByV9rTme23Vt783sqWjZjEtjtMGUo4cxHvFoewmvItfIp0JYoIwfnjRVNK/uRRnIAqosnxmH5Lr8IatWRFqVH6WaVIf5Fn+NDPUVF8UI2+78FvbZfeddNNNmGqr8m/j6BYZLWW4krsTlIcIIUP5aO8jmg6soQln05/uSTgQstlhm3UEc/G+BPMdzYvXDNgcMCqfOw+fsXPgTbfH5VryNrVA2GZ3pkkumLmTPr0lqgI+qkBE/YFuDGkPJanQl74/rxhFZEgzt0hJRfsF7u7TITry+4MFyhOjob+sq4yWwQ71QyY28ivLt8lQfZsBH6mKUk8Jgge6hk45sPHd7nXSOeAO2uMr+iBr/u2Wf1z5/KqB+ftG9KaHmSEmeU9uLo5z/3g4MtUt6F/ZE+GRXE/sJg8YqdZcQ/nBhtreePdX9pZhlNeBDFiLzAfhm7zmyLLhaTOtTBkwCoilc2XazcASFky+Cvy1oMkVeN/K6CuGDsVvGwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFH3ZYvZskV07lrAXICI6I9lAazpJMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwPgYDVR0gBDcwNTAzBgZngQwBBAEwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQDUFsZWQJeNmFx5Qvr0gQvPwUc0VgRHThr0M69gIzTIf5NzDsKiCr/V6q4u9Se8kJrHxp4lFraH5ncW8RQSEJTgsR+MpBfWMLx7GO6LmekcWiwwEe7KW7sCt4Pw0Zz9wysdm2w2RRCKo+YlMLbOh5ts+FmV2g3xSyCZoI0olBD1ja8FWdPCVA9qM6Cp+WC9qi8nOYMPEQGz8m9/HZ7Xtd6iVYEUnlf9moeO2WEf1EOojJzdNwN43gkGX3Wo47pXTTmRnDucraSg9nIz9orvc2Xhq9PWu2fM3n3Z/CfWEtfSBfJ5TBXY6JXaVaQb3y/fie3L71bDdiQtbuxINeee0p9Ctya3CJHTO+K1BhFHYjaSmJDwInh4mNr9z28Hs6IVS5Pl+eew9IX+3a++X2s+qiGIsauiR9DvvcpwDcwiQdxTnsepui5hsPZGgSjsY3sqXt+8Jos4uhqqg6tIdywPPjZFVBzkiqBm38JQUHaKeAU1pe/t7V4JyYYtOYSTHuYXRLg8VdmrVNmt0jlLCvtYYqNTJQy0sVg3WEogRC2Hp3haXOBPizTq6mdeeYDYU65ADQfgq5P6reuZ76AWCuoKVsaVUT2Bm+I1p46kVj5pIvjcCLXNX/vMHH62tn20eiukFpDwUVEDwDkX4pGxI2XjIEOjXhqMK8OYfSmO1GWglXWqMg==",
        "src_file_sha256": "a48d80e35636a24613adcb9b1f928eeef86073a580878d023871bc762ac8a2c8",
        "src_file_path": "downloaded_files/res_automation_manager/a48d80e35636a24613adcb9b1f928eeef86073a580878d023871bc762ac8a2c8",
        "src_file_company": "Ivanti"
      }
    ]
  }
}