{
  "Name": "Tanium",
  "Category": "RMM",
  "Description": "Tanium is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://www.tanium.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "TaniumClient.exe",
      "TaniumCX.exe",
      "TaniumExecWrapper.exe",
      "TaniumFileInfo.exe",
      "TPowerShell.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "cloud.tanium.com",
          "*.cloud.tanium.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/tanium_network_sigma.yml",
      "Description": "Detects potential network activity of Tanium RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/tanium_processes_sigma.yml",
      "Description": "Detects potential processes activity of Tanium RMM tool"
    }
  ],
  "References": [
    "https://help.tanium.com/bundle/ug_client_cloud/page/client/platform_connections.html"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [],
    "company_names": [],
    "signer_names": [
      "Tanium Inc."
    ],
    "certificates": [
      {
        "signer_name": "Tanium Inc.",
        "certificate_thumbprint": "A55D7760CF404CA1F4D1F60861302BDE90B21B01",
        "tbs_sha256": "5285CC0A00FA0FA20FAEB8043102876D147FBBEFDD0A66821991559382370ADA",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIHvDCCBaSgAwIBAgIQBfDEJ2ruHsI1Ojv7HbK25zANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MTEwNjAwMDAwMFoXDTI3MTEzMDIzNTk1OVowgcQxEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwc0MzMyMjcwMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKRW1lcnl2aWxsZTEUMBIGA1UEChMLVGFuaXVtIEluYy4xFDASBgNVBAMTC1Rhbml1bSBJbmMuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7N2pGG876KRBUUdL4UbMpO5Arsi4vLchj1SQxsDbAcEATdD2l/r4IhEn9Ee/5x7A11+dpTjtd+nLeMnpEQ3ntUp6s6JSmQ2t6xUab8nNR+BI4oPPutqnkpTFGa8iyLR74G29MfSNk2rYyCmobTeROCmXM5t0/7RBIcVyteMZ18dFRapYo3UC6n9H2y6zJoCzbFSdFzVX37WITrIBzAp5NJREHA94GfZEt2cBbMVtVBt0ks9wpHONSoYc1B9hF2W6DRKoZ2M3nquznVzfdhYz7FfafqX+JcKJvU7c47MHgp5vZrkixRmnw9OBooEL6mB5sr9X+0JfiojpnzZ4ZCMa2s4XhKAY3BAt3Qb2tDS2xpvbrWavHHhoOqvwVW4m7/63tHPTF+lcEmw7VwJg+rRdf3vnWFHjPU76/k6EN8IpHm9UcAuzs++rPQuPh/ZQ2V6Ri010EtbdQuL0Dd+i5o2FZuhJnPTMykxwlXhf/egLlkktXpgiLJXG5zITlDrjv2af0yS9yQVa4oBxPvbhNIn36A9asXg5DaXtDhD6CeBJfN/1o1dNQMQmX3ResyMkrTA75Tr9gn9xYDpsk1uZ/2tIe4Nw2m07DIBiA8JNIuW8tMMZgWG/j6r4Egncu+MZlYP2Zfo4I901mCNhT5zEOVqjlPCuHO9ah9iry7iLvXWOPXECAwEAAaOCAgIwggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBR/RY/hHQXFx3VoGG3PElrlGnha/TA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCnAJdFg12oeQnmWLUXkCsu0F6ssE0SXE2x5cXBWy6TkeDMYp9+ZpS1DMjGjFFGQ6mmN6ra3zjMRopKS3VVsVHCo5T5x6jUjVH9V7dwgVIh89yeqMBrjiDXVXyJ/cBESkNCQ5hg2aKQx90HLPO4FI9Lp1xt7YNRKMIOhIjTdTY9Bo9wz/NZJ49cXqOf8AMoFgc/fRgS6wBpj8AhC87KsyL8S4j4c+CzhdCWhwluZGyxyj9LUrkNAyEEE6qHBPzGGEXGh86rD1k+iKynvzPo7pDo6GDE/qfOEcb5CsdOImh0hdzGFgGqarVZ/wM64Zr7HT1WLFP4spjpiU2WP/MI2cTfHZ/lWHg/1lU4z7A0zhEUQg0JTTq1DUh0Csy59s8pj1s9/d/JkA6RNSy39ndH9iEonpTkH3Etji1y8qDLq+Pxj6mOwDDG2naIaDlk7M8eyfo2MN8tKY1yXQXM9pfLLUR9+PZdabPQHXmldiORh3CDcwjMyr/RQ9Y42H0cN4qoEL31fAagYOd5OB6iOPfmFHyYDOytspqeYgJiV96G0ifUYLOebDHbMBZtYLUl7falpXz5zoeirEwLiNxPtHVSoP+bk1gYupqP1nCq4Ub8/KfEzCG24Pm+MyADGax3mIchOw4SLOx6M0DKNGzX9w3F9rYvg2gGmNU6t9WexLCE7lReNQ==",
        "src_file_sha256": "3be87ff5ce6a9e0104110027478dbc1ce63c97a5cd1324f06d92d97857afbaf3",
        "src_file_path": "downloaded_files/tanium/3be87ff5ce6a9e0104110027478dbc1ce63c97a5cd1324f06d92d97857afbaf3",
        "src_file_company": "Tanium Inc."
      },
      {
        "signer_name": "Tanium Inc.",
        "certificate_thumbprint": "B1AFC12445071A3724621CDD56A4F1ADC4C67E9E",
        "tbs_sha256": "C16C5B0D333FA6422E19D0012405C88511A01A6FB272E9C915E18668270710B9",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIH7zCCBdegAwIBAgIQCZsFgdT3DF76ZkDZqnqdpDANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMjU2IDIwMjEgQ0ExMB4XDTIxMTIxNjAwMDAwMFoXDTI0MTEyNzIzNTk1OVowgcQxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRMwEQYLKwYBBAGCNzwCAQMTAlVTMRkwFwYLKwYBBAGCNzwCAQITCERlbGF3YXJlMRAwDgYDVQQFEwc0MzMyMjcwMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKRW1lcnl2aWxsZTEUMBIGA1UEChMLVGFuaXVtIEluYy4xFDASBgNVBAMTC1Rhbml1bSBJbmMuMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvHO7ZQERzFdvZMBTz6EWnRzMG/yywwSCTZatC7BEj3m3SzpbxvLixt0ZyaY1GfFPzzzs6BzBqpNhX8EP9MnFiRkkDh05BZuLwkHkpKQbgkFtDNqN8/o9+J2oMPGIEplypPCTKNiKUWitNQRGtZQgeeCzCVWtgXgfUDi4/RaSDC2m6pKsvwkYGy+YHGVTAqBGiAD7Coib9jAkyvp+ThXFR2Sn745DGZ3rIFyPkAdxsvLrjfiBr+eXdtQ3gO4nFOlb7+PuBmdjzxatW6Pz/3hIcZ5SXA6fCPoZDPozyiylvrPJayFUZ7YXXHcldk7r2xcaexNPuPXOGOt8bwq3Y2zXGIO/L65jG8mSXKq82YesX+Faqp8SoETPJPdSdiDdRFLOixKVIEkzLrf2ZfoorXrSAdMESRlKWdsi/+8oxVkDyG6DesNavwzV81T+pMJisKlkwOjE8FKhSiqfOiO4gRvpitVMcCO+XHExlMMShNpCcie+3OZy+OLt6Lpr36lRGGTVYEebQo2RIvqMJ8OVwJQaSDmuVxHq2tMnkDZf4P5ieapT1VVarXtqSzqVt2RJRiHNyy3FpihUT7rEiCzgm/vpoxzjAlqR4kszc9Pi3HlwyK5j0ciVXfNFBZc3twoCHisjUnVAF93aDTJsVgk19q0O0XvrV1h6f4wSOrP8WyKj45cCAwEAAaOCAjUwggIxMB8GA1UdIwQYMBaAFLxrImWdjGjm5h4F8dhyJdS44EjAMB0GA1UdDgQWBBSMqXgk0mgVZNyiiysehHjeoccVXjAuBgNVHREEJzAloCMGCCsGAQUFBwgDoBcwFQwTVVMtREVMQVdBUkUtNDMzMjI3MDAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMjU2MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTI1NjIwMjFDQTEuY3JsMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEyNTYyMDIxQ0ExLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQCg7L9uQYV9loolc8MRoSU+PW89FP2WIrR5Ri+uyebptaNDHehp1kCt2pSVcEDAXA7+h8gyh3nOJG+L8BzBGHo7Ssrr8OHv9SxfLFKNCTYExE+p/qCM0zSNEcKSuN6bA9yFtSaXCpppKxXzUT3MUQUEtYApQ7mfTHHj/qnZXNmbt1CkWUv/iWNzCOk81HvR+X/LFVXw02nwuodgmU4XOB2deGeiDjsDSTJMh3uESuwBLwmgD0uoARdwdDhyXP7N7ZfqT/2w7F3mKr8Sz4hADybgEPEBxvgTky/cKl84+F1n+2hlpfHIevRgc/Eavym3Qbit+kK3w63AATHDlgUtyOItqQ75nQpRRYJf0C+aNtQ/Qn0MbNmUwdNyfRehUespgV/vWguCzdrJDslmiJCeD8zhA4uyBDZ+B4u7J2EnnWRGIEJzTW4uQ0Qcf5G8xTD7HODfYUAOvNKi/TxpaxHeF/1VvMdv5zoumIYN0IewW47ZFYgkukDB+7OOvmB6KN0Mbr0C1KxuFu3tHrgieQnlhP4eza2/nLr/p5mUIPExpqu5QS9oA98wxKksf3lkwZtpcKOXr1c6Qyn+LIPdA8auauP7yHPk2ul4HHUQtCLUhut9ldlrSj+x+iI6EQyMWTWrS/us43LyLWPyya9ss5E0ybBVCDQ1YVi6PibSwBBVTL1eUA=="
      },
      {
        "signer_name": "Tanium Inc.",
        "certificate_thumbprint": "D6A226A8280A4C97C3251B3A7B4D5F17E8C05A08",
        "tbs_sha256": "81E8FEBE467DE9D69FB9A33AD320613D7BB6AA313E0310568D19FDC05FFD2EFA",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIFHjCCBAagAwIBAgIQBTcaTDZZlI9VNXRruID8OjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMTEwLwYDVQQDEyhEaWdpQ2VydCBTSEEyIEFzc3VyZWQgSUQgQ29kZSBTaWduaW5nIENBMB4XDTE4MDIwMTAwMDAwMFoXDTE5MDIwNTEyMDAwMFowWzELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpFbWVyeXZpbGxlMRQwEgYDVQQKEwtUYW5pdW0gSW5jLjEUMBIGA1UEAxMLVGFuaXVtIEluYy4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCxiq1HAob4pCT6tvD8p5hdtBvDUbPg+VqYdn64fHil5ytf+r6FEon137hfursTkzWN9zf8EfibVAAkDrD7pwd8iEqzMjlm20ZQPeV5EhkdsJcP4BOK+xFUbpjjg3EmCjAI0qqiyFuKtnOnixSQ8n6IZcFTzD+ilRV/P17hBpOIe+d8DpVMQcIHY9Rne+D3pBP0NGkHl+yKnDqs2DseG1pw+VR55NdQM24HkAZ/OziTwzoAC59iPMamuIb85RpQ0nyvnzobR4iHTQBpEe3prUqXMWezym2V31bN/NSbywB0RN4Ltcvyz5fYsdBePKdnlynOCHuvd3i74HudyYwb2FhJAgMBAAGjggHFMIIBwTAfBgNVHSMEGDAWgBRaxLl7KgqjpepxA8Bg+S32ZXUOWDAdBgNVHQ4EFgQUpdfdYc07usn5Wr6BU4ywaWh0bVYwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMHcGA1UdHwRwMG4wNaAzoDGGL2h0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zaGEyLWFzc3VyZWQtY3MtZzEuY3JsMDWgM6Axhi9odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc2hhMi1hc3N1cmVkLWNzLWcxLmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwDATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAEEATCBhAYIKwYBBQUHAQEEeDB2MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wTgYIKwYBBQUHMAKGQmh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJBc3N1cmVkSURDb2RlU2lnbmluZ0NBLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCa3w8YAZjSNgDqWimZE8SfiYB21KFQq+dgQrjU6dTWRLcmRXgfnI2sQBWjiszhgMurhiFaXWkuqcN4ZiBB3dIKoZicNO0vg9xw0xhvWAJ8ewdNviGY1xmh/myymuE7WxH7YyAu/Hb2Lr9P2cQOwzLZQp45Y2oXNyWETWUJ7UiZyqWJE/NRNggdMf7weH9VY+aO/PIf5YKcAfNg1YFUuMYIfi2oq8vJcKK106XLgTR6H+Oc7sbYPshViQvFs5XsmjbdGb9RFyT0DRv1rh/QUf1U4ePsHWZdTdWpo6nlu+auejzwWBVmB5Qc4NCgdDcucbCBO4F8xx4dYKxHIkbMhqgm"
      },
      {
        "signer_name": "Tanium",
        "certificate_thumbprint": "F092414A2EA9FD375D4DB7D16B81906B522F2E37",
        "certificate_der_base64": "MIIC8jCCAdqgAwIBAgIQF6yGcvDv/7FC58ga7iOHJjANBgkqhkiG9w0BAQsFADARMQ8wDQYDVQQDDAZUYW5pdW0wHhcNMjUwODExMjAyNjQ1WhcNMjYwODExMjA0NjQ1WjARMQ8wDQYDVQQDDAZUYW5pdW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOp/L/nf8lDjIdThWmzM6a4MqH9SMXWW33q5B/FR65rzgkLuHZu54t9xSUtZu2WQ9oyA6uLLKkps7JKEYJUFAxeBZo55VhTgaDuaV/X2KMEeSTdQLFgDaw8Yts9wxvJfRZoj6VLcBXGsrNbl4Go1vbASSzaD6OdNl6m9amt6ZnM3gXZJrhAW1Gv0yCGz0ZTwYhVLc2kILua1eiaGWM5bxmUVDDnYc4KSH1QeRoW02USNMol30wgs5tgt/ETDQ39f1OXVwMhV/S2IVmphhtZAPpOzxcCLtEYRFcVZUhL21hs5MiiUQt2aUPsD50HtYjnZBy4WETMPGU2jsVLGqTvtiFAgMBAAGjRjBEMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUn+2J7ytNmZIIiEIN24JCZbEgXkgwDQYJKoZIhvcNAQELBQADggEBAAmAPbbej0QNAlAaOQRM05cJTUnQ1fO5zkZcEj9g6OBKI3X6So5ki3M/dbIO0K6HCdvbT4DNJhCQNaQcHcfheqhe3VyD9NoAOZAhv8pYWPG7cdQVqBOeUoReSaVxmiBEN0H5jzUnSh03m0pVRChJeCmnaPCUt6T9GhOwrSy1IVOsmPqVi34ZCaIt4A4uCevUxy6YYujcGNHQpqu1JxyZUwPXDVAQbjFZPoLg6scEjlyYLicEbLv5fZJ8QydaJQaXMRTgDAlEUQ27CFv6ET5eaDOOQH3of0+OxMV1m3/fHPJmjacMTBdx1eMSpf/OPEDTg/mE4PCfYSEFxXuKxDauuqQ=",
        "src_file_sha256": "9c25d19ee1ea68a1a4e729dc0fab0bf879e63c4ab599f86f2e9b5ca961671a84",
        "src_file_path": "downloaded_files/tanium/9c25d19ee1ea68a1a4e729dc0fab0bf879e63c4ab599f86f2e9b5ca961671a84",
        "src_file_company": "www.tanium.com"
      }
    ]
  }
}