DETECT / INVESTIGATE / DEFEND
Put the intelligence to work.
Find remote access activity in your environment with community detection rules and hunting queries. Tune each query to your approved tools and available telemetry.
Microsoft Defender for Endpoint
Hunt for connections to known RMM domains using DeviceNetworkEvents. Replace the SanctionRMM list with your organization's approved domains. For Microsoft Sentinel, replace both Timestamp references with TimeGenerated.
// Detecting Unauthorized RMM Instances in Your MDE Environment
// Note: this query targets Microsoft Defender for Endpoint (DeviceNetworkEvents.Timestamp).
// For Microsoft Sentinel, replace both `Timestamp` references with `TimeGenerated`.
// Wildcard CSV entries are normalized to domain suffixes, then matched with a host boundary.
let SanctionRMM = dynamic(["bomgarcloud.com"]); // Replace with your approved RMM domains, e.g. dynamic(["teamviewer.com", "anydesk.com"])
let RMMList = externaldata(URI: string, RMMTool: string)
[h'https://raw.githubusercontent.com/magicsword-io/LOLRMM/main/website/public/api/rmm_domains.csv']
with (format="csv", ignoreFirstRecord=true)
| extend RawURI = tolower(trim(@"[ \t\r\n]+", URI))
| project Domain = trim_end(@"\.+", case(
RawURI startswith "*.", replace_string(RawURI, "*.", ""),
RawURI startswith "*", replace_string(RawURI, "*", ""),
RawURI contains "*", replace_regex(RawURI, @".+?\*", ""),
RawURI
))
| where isnotempty(trim(@"\.+", Domain));
let RMMDomains = toscalar(RMMList | summarize make_set(Domain));
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where ActionType == "ConnectionSuccess"
| extend RemoteUrlClean = tolower(tostring(RemoteUrl))
| extend RemoteHost = case(
RemoteUrlClean startswith "http://", tostring(parse_url(RemoteUrlClean).Host),
RemoteUrlClean startswith "https://", tostring(parse_url(RemoteUrlClean).Host),
tostring(split(RemoteUrlClean, "/")[0])
)
| extend RemoteHost = trim(@"\.+", tostring(split(RemoteHost, ":")[0]))
| where isnotempty(RemoteHost)
| where not (RemoteHost has_any(SanctionRMM))
| mv-expand Domain = RMMDomains to typeof(string)
| extend DomainRoot = trim(@"\.+", Domain)
| where RemoteHost == DomainRoot
or RemoteHost endswith strcat(".", DomainRoot)
or (Domain startswith "-" and RemoteHost endswith Domain)
| summarize arg_max(Timestamp, *) by DeviceIdSplunk
This query requires Splunk Enterprise Security, the Network Traffic data model, and the Remote Access Software lookup. Configure the referenced macros and exception lists for your environment.
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.dest_port) as dest_port latest(user) as user from datamodel=Network_Traffic by All_Traffic.src All_Traffic.dest, All_Traffic.app
| `drop_dm_object_name("All_Traffic")`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| lookup remote_access_software remote_appid AS app OUTPUT isutility, description as signature, comment_reference as desc, category
| search isutility = True
| `remote_access_software_usage_exceptions`
| `detect_remote_access_software_usage_traffic_filter`Sigma rules
Use process and DNS indicators in your SIEM. The rules below are generated from the catalog. Review the indicators and tune expected remote management activity before deployment.
View process detection rule
title: Generic RMM Tool Detection
id: ba1e3a37-6751-48e8-9f7a-73d9062f137c
status: experimental
description: Detects processes associated with common Remote Monitoring and Management
(RMM) tools that could be used for lateral movement
references:
- https://github.com/magicsword-io/LOLRMM
author: LOLRMM Project
date: '2025-03-18'
modified: '2026-10-05'
tags:
- attack.command-and-control
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '*\\AppData\\Roaming\\Microsoft\\DeviceSync\\svchost.exe'
- '*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe'
- '*\\AppData\\Roaming\\Overlord\\agent.exe'
- \\aa_v*.exe
- \\aadg.exe
- \\accessserver*.exe
- \\accessserver.exe
- \\AcronisCyberProtectConnectAgent.exe
- \\AcronisCyberProtectConnectQuickAssist*.exe
- \\AEMAgent.exe
- \\AeroAdmin.exe
- \\agent-installer-any.exe
- \\agent-windows-amd64-*.exe
- \\agent32.exe
- \\agent64.exe
- \\Agent_*_RW.exe
- \\agent_setup_5.exe
- \\AgentlessRC.exe
- \\AgentMaint.exe
- \\AgentMonitor.exe
- \\AgentPackageNetworkDiscovery.exe
- \\AgentPackageTaskScheduler.exe
- \\AgentSetup-*.exe
- \\agentu.exe
- \\alitask.exe
- \\allocentra-agent.exe
- \\AlpemixService.exe
- \\AMMYY_Admin.exe
- \\amon.exe
- \\AnyDesk-*.exe
- \\AnyDesk.exe
- \\apc_host.exe
- \\ArcUI.exe
- \\aspia_client.exe
- \\atera_agent.exe
- \\AteraAgent.exe
- \\auvik.agent.exe
- \\auvik.engine.exe
- \\aweray_remote*.exe
- \\AweSun.exe
- \\awhost32.exe
- \\awrem32.exe
- \\BASEClient.exe
- \\BASupApp.exe
- \\BASupAppElev.exe
- \\BASupAppSrvc.exe
- \\BASupSrvc.exe
- \\BASupSrvcCnfg.exe
- \\basupsrvcupdate.exe
- \\BASupSysInf.exe
- \\BASupTSHelper.exe
- \\bbl.exe
- \\beacon-agent.exe
- \\beamyourscreen-host.exe
- \\beamyourscreen.exe
- \\Beinsync*.exe
- \\bomgar-pac-*.exe
- \\bomgar-pac.exe
- \\bomgar-rdp.exe
- \\bomgar-scc-*.exe
- \\bomgar-scc.exe
- \\BvSshClient-Inst.exe
- \\BvSshServer-Inst.exe
- \\CagService.exe
- \\cbb.exe
- \\CBBackupPlan.exe
- \\client32.exe
- \\clientmrinit.exe
- \\Cloud.Backup.RM.Service.exe
- \\Cloud.Backup.Scheduler.exe
- \\cloudflared.exe
- \\CloudRaCmd.exe
- \\CloudRaSd.exe
- \\CloudRaService.exe
- \\CloudRaUtilities.exe
- \\CloudWksInstall.exe
- \\ComodoRemoteControl.exe
- \\Connect.Backdrop.cloud*.exe
- \\Connect.exe
- \\ConnectAppSetup*.exe
- \\ConnectDetector.exe
- \\ConnectShellSetup*.exe
- \\connectwise*.exe
- \\connectwisechat-customer.exe
- \\ConnectWiseControl*.exe
- \\connectwisecontrol.client.exe
- \\ControlR.Agent.exe
- \\ControlR.DesktopClient.exe
- \\CoreAgentService.exe
- \\CrossLoopConnect.exe
- \\crossloopservice.exe
- \\csexec.exe
- \\ctes.exe
- \\cteshostsvc.exe
- \\ctespersistence.exe
- \\ctiserv.exe
- \\DameWare Mini Remote Control*.exe
- \\DameWare Remote Support.exe
- \\dashboard-windows-amd64.exe
- \\dcagentregister.exe
- \\dcagentservice.exe
- \\dd.exe
- \\ddsystem.exe
- \\DepHlp.exe
- \\Deskroll.exe
- \\DeskRollUA.exe
- \\desktopnow.exe
- \\DFC.exe
- \\DFInst.exe
- \\DFServ.exe
- \\DFServEx.exe
- \\DFStd.exe
- \\DFStdInstall.exe
- \\DFWks.exe
- \\distant-desktop.exe
- \\dntus*.exe
- \\DocConnect.Agent.exe
- \\Domotz Pro Desktop App Setup*.exe
- \\Domotz Pro Desktop App.exe
- \\domotz*.exe
- \\domotz-windows*.exe
- \\domotz.exe
- \\domotz_bash.exe
- \\DragonDisk.exe
- \\DSGuest.exe
- \\duet.exe
- \\DuetDisp.exe
- \\DuetSetup.exe
- \\Duplicati.Server.exe
- \\dwagent.exe
- \\dwaglnc.exe
- \\dwagsvc.exe
- \\dwrcs.exe
- \\dwrcst.exe
- \\echoserver*.exe
- \\ehorus standalone.exe
- \\ehorus_agent.exe
- \\ehorus_cmd.exe
- \\ehorus_launcher.exe
- \\ehorus_uit.exe
- \\einstaller.exe
- \\era.exe
- \\ERAAgent.exe
- \\eratool.exe
- \\ericomconnectconfigurationtool.exe
- \\EricomConnectRemoteHost*.exe
- \\ExtraPuTTY-0.30-2016-01-28-installer.exe
- \\ezhelp*.exe
- \\ezhelpclient.exe
- \\ezhelpclientmanager.exe
- \\ezHelpManager.exe
- \\FaronicsCoreAgent.exe
- \\FaronicsDeployAgent.exe
- \\FaronicsSA.exe
- \\fastclient.exe
- \\fastmaster.exe
- \\FastViewer.exe
- \\FIStudentAgent.exe
- \\FIStudentSvc.exe
- \\FIStudentUI.exe
- \\FixMeit Client.exe
- \\FixMeit Expert Setup.exe
- \\FixMeit Unattended Access Setup.exe
- \\FixMeitClient*.exe
- \\fixmeitclient.exe
- \\fleetdeck-agent.exe
- \\fleetdeck_agent.exe
- \\fleetdeck_agent_svc.exe
- \\fleetdeck_commander_launcher.exe
- \\fleetdeck_commander_svc.exe
- \\fleetdeck_installer.exe
- \\FRCServer.exe
- \\Freshservice.DiscoveryProbe.ScanService.exe
- \\Freshservice.DiscoveryProbe.Window.exe
- \\FSAgentAutoUpdate.exe
- \\FSAgentService.exe
- \\FSSInstaller.exe
- \\FSWmiScanner.exe
- \\FWA_UI_Agent.exe
- \\FWAService.exe
- \\FWAWebInstaller_*.exe
- \\g2a*.exe
- \\g2ax_comm_customer.exe
- \\G2M.exe
- \\g2mcomm.exe
- \\getscreen-x86.exe
- \\getscreen.upd.exe
- \\GoTo Assist Opener.exe
- \\goto opener.exe
- \\gotoassist.exe
- \\GotoHTTP*.exe
- \\gotohttp.exe
- \\GotoHTTP_x64.exe
- \\GoToResolveExternalModuleHandler.exe
- \\GoToResolveFileManager.exe
- \\GoToResolveLoggerProcess.exe
- \\GoToResolveNetworkChecker.exe
- \\GoToResolveProcessChecker.exe
- \\GoToResolveQuickView.exe
- \\GoToResolveRegistryEditor.exe
- \\GoToResolveRemoteControl.exe
- \\GoToResolveService.exe
- \\GoToResolveServiceManager.exe
- \\GoToResolveTerminal.exe
- \\GoToResolveTools32.exe
- \\GoToResolveTools64.exe
- \\GoToResolveUi.exe
- \\GoToResolveUnattended.exe
- \\GoToResolveUnattendedRemover.exe
- \\GoToResolveUnattendedUi.exe
- \\GovAgentInstallHelper.exe
- \\GovAgentx64.exe
- \\goverrmc.exe
- \\GovReachClient.exe
- \\govsrv*.exe
- \\GovSrv.exe
- \\gp3.exe
- \\gp4.exe
- \\gp5.exe
- \\guacd.exe
- \\GxM.Agent.exe
- \\hbrm-updater-x64.exe
- \\hbrm-x64.exe
- \\helpbeam*.exe
- \\helpu_install.exe
- \\HelpuManager.exe
- \\HelpuUpdater.exe
- \\HelpWire Quick.exe
- \\helpwire.exe
- \\HopToDesk-Standalone.exe
- \\HopToDesk.exe
- \\hsloader.exe
- \\I'm InTouch Go Installer.exe
- \\iadmin.exe
- \\id_tray.exe
- \\IDriveEClassic.exe
- \\IDriveWinSetup.exe
- \\ihcserver.exe
- \\iit.exe
- \\IliAS.exe
- \\ImmyAgent.exe
- \\ImmyBot.Agent.Ephemeral.exe
- \\ImmyUpdater.exe
- \\ImperoClientSVC.exe
- \\ImperoInit.exe
- \\InsightInstaller.exe
- \\InsightInstallerStudent.exe
- \\InsightInstallerTeacher.exe
- \\InstallCore.exe
- \\InstallShield Setup.exe
- \\InstantHousecall.exe
- \\Insync.exe
- \\intelliadmin.exe
- \\intouch.exe
- \\InvGate-ED.exe
- \\InvGateAssetsRD.exe
- \\InvGateRD.exe
- \\iperius.exe
- \\iperiusremote.exe
- \\ir_agent.exe
- \\islalwaysonmonitor.exe
- \\ISLLight.exe
- \\ISLLightClient.exe
- \\isllightservice.exe
- \\issuser.exe
- \\ITAgentRMMSender.exe
- \\ITAgentRMMSenderSL.exe
- \\ITAgentRMMSenderUpdater.exe
- \\ITarianRemoteAccessSetup.exe
- \\ITSMAgent.exe
- \\ItsmRsp.exe
- \\ITSMService.exe
- \\IvantiRemoteControl.exe
- \\jumpclient.exe
- \\JumpCloud*.exe
- \\jumpconnect.exe
- \\jumpdesktop.exe
- \\jumpservice.exe
- \\jumpupdater.exe
- \\Kabuto.App.Runner.exe
- \\Kabuto.Installer.exe
- \\Kabuto.Service.Runner.exe
- \\KabutoSetup.exe
- \\KHelpDesk.exe
- \\kitty.exe
- \\konea.exe
- \\landeskagentbootstrap.exe
- \\LANDeskPortalManager.exe
- \\laplink-everywhere-setup*.exe
- \\laplink.exe
- \\laplinkeverywhere.exe
- \\LavawallWin.exe
- \\ldinv32.exe
- \\ldsensors.exe
- \\level-remote-control-ffmpeg.exe
- \\level-windows-amd64.exe
- \\level.exe
- \\llrcservice.exe
- \\lmi_rescue.exe
- \\lmi_rescue_srv.exe
- \\LMNoIpServer.exe
- \\loclx.exe
- \\LS RMM Worker.exe
- \\LS RMM.exe
- \\ltsvc.exe
- \\ltsvcmon.exe
- \\lttray.exe
- \\Lunixar.exe
- \\LunixarRemote.exe
- \\LunixarUpdater.exe
- \\ManageEngine_Remote_Access_Plus.exe
- \\ManageEngine_ServiceDesk_Plus.exe
- \\ManualLauncher.exe
- \\MEAgentHelper.exe
- \\MEGAsyncSetup64.exe
- \\MEGAupdater.exe
- \\meshagent*.exe
- \\meshcentral*.exe
- \\mgntsvc.exe
- \\MigrationHelper_32.exe
- \\MigrationHelper_64.exe
- \\Mikogo-Screen-Service.exe
- \\Mikogo-Service.exe
- \\mikogo-starter.exe
- \\mikogo.exe
- \\mikogolauncher.exe
- \\MiniRmmAgent.exe
- \\mionet.exe
- \\mionetmanager.exe
- \\ModulesUpgradeMgr.exe
- \\MonitoringAgent.exe
- \\mRemoteNG.exe
- \\msp-agent-core.exe
- \\mstsc.exe
- \\mwcliun.exe
- \\mygreenpc.exe
- \\myivomanager.exe
- \\myivomgr.exe
- \\nateon*.exe
- \\nateon.exe
- \\nateonmain.exe
- \\netbird-ui.exe
- \\netbird.exe
- \\NetLock_RMM_Agent_Installer.exe
- \\NetLock_RMM_User_Process.exe
- \\NetLock_RMM_User_UAC.exe
- \\NetMaster_Client.exe
- \\Netop Ondemand.exe
- \\neturo*.exe
- \\neturo.exe
- \\netviewer*.exe
- \\NetViewer.exe
- \\nexusrmm.exe
- \\nezha-agent.exe
- \\ngrok.exe
- \\ngstw32.exe
- \\nhostsvc.exe
- \\nhstw32.exe
- \\Ninite.exe
- \\NiniteAgent.exe
- \\NiniteOne.exe
- \\NinitePro.exe
- \\ninjarmm-cli.exe
- \\NinjaRMMAgent.exe
- \\NinjaRMMAgentPatcher.exe
- \\nldrw32.exe
- \\nmep_agtconfig.exe
- \\nmep_ctrlagent.exe
- \\nmep_ctrlagentsvc.exe
- \\nomachine*.exe
- \\NotificationHelper.exe
- \\ntrntservice.exe
- \\NTRsupportPro_EN.exe
- \\nvClient.exe
- \\nvConsole.exe
- \\nvda.exe
- \\nvda_*.exe
- \\nvda_service.exe
- \\nxd.exe
- \\nxplayer.exe
- \\nxservice*.exe
- \\obliance-agent.exe
- \\obliance-tray.exe
- \\obliance-watchdog.exe
- \\ocsinventory.exe
- \\ocsservice.exe
- \\onionshare*.exe
- \\Online Backup.exe
- \\oolocker.exe
- \\OOSysAgent.exe
- \\oosyspectr.exe
- \\opale-agent.exe
- \\OpenDesk-RMM-Agent.exe
- \\OpsBridgeAgent.exe
- \\OrayRemoteService.exe
- \\OrayRemoteShell.exe
- \\OTPowerShell.exe
- \\OTService.exe
- \\ovd_*.exe
- \\p9agent*.exe
- \\PAExec-*.exe
- \\paexec.exe
- \\parallelsaccess-*.exe
- \\parsecd.exe
- \\pcaquickconnect.exe
- \\PcHelpWare_viewer.exe
- \\pcicfgui.exe
- \\pcictlui.exe
- \\PCIVIDEO.EXE
- \\PCMonitorManager.exe
- \\pcmonitorsrv.exe
- \\pcnmgr.exe
- \\pcstarter.exe
- \\pcvisit-easysupport.exe
- \\pcvisit.exe
- \\pcvisit_client.exe
- \\pcvisit_service_client.exe
- \\pdq-connect*.exe
- \\Pilixo_Installer*.exe
- \\PixoIT-agent.exe
- \\plink.exe
- \\pocketcloud*.exe
- \\pocketcloudservice.exe
- \\pocketcontroller.exe
- \\prl_deskctl_agent.exe
- \\prl_deskctl_wizard.exe
- \\prl_pm_service.exe
- \\proxiport.exe
- \\pservice.exe
- \\psexec.exe
- \\psexec64.exe
- \\psexecsvc.exe
- \\pstlaunch.exe
- \\ptdskclient.exe
- \\ptdskhost.exe
- \\putty.exe
- \\puttytray.exe
- \\qq.exe
- \\qqpcmgr.exe
- \\QQProtect.exe
- \\quickassist.exe
- \\raautoup.exe
- \\RAccess.exe
- \\Radmin.exe
- \\rapid7_agent_core.exe
- \\rapid7_endpoint_broker.exe
- \\rcengmgru.exe
- \\rcmgrsvc.exe
- \\rcstartsupport.exe
- \\rd.exe
- \\rdclient.exe
- \\RdClientInstaller.exe
- \\RDCMan-x86.exe
- \\RDCMan.exe
- \\RDConsole.exe
- \\RDesktop.exe
- \\rdp.exe
- \\rdp2tcp.exe
- \\RDPCheck.exe
- \\RDPConf.exe
- \\RDPWInst.exe
- \\remcmdstub.exe
- \\remcom.exe
- \\remcomsvc.exe
- \\remcos*.exe
- \\remmon.exe
- \\remobo.exe
- \\remobo_client.exe
- \\remobo_tracker.exe
- \\remote access.exe
- \\Remote Desktop.exe
- \\Remote Workforce Client.exe
- \\remote-it-installer.exe
- \\remote.it.exe
- \\RemoteAgentAgent.exe
- \\remoteconsole.exe
- \\RemoteDesktopManager.exe
- \\remoteit.exe
- \\Remotely_Agent.exe
- \\Remotely_Desktop.exe
- \\remotepass-access.exe
- \\RemotePC.exe
- \\remotepchost.exe
- \\RemotePCService.exe
- \\RemoteRipple.exe
- \\remotesupportplayeru.exe
- \\remoteview.exe
- \\remoting_host.exe
- \\RemSupp.exe
- \\rfusclient.exe
- \\RHost.exe
- \\RMM.Agent.exe
- \\RMMmaxAgentService.exe
- \\RMMmaxAgentSetup.exe
- \\RmmService.exe
- \\rmserverconsolemediator.exe
- \\RocketRemoteDesktop_Setup.exe
- \\RodexAgent.exe
- \\ROMFUSClient.exe
- \\ROMServer.exe
- \\romviewer.exe
- \\routernt.exe
- \\royalserver.exe
- \\royalts.exe
- \\rpaccess.exe
- \\rpcld.exe
- \\rpcnet.exe
- \\rpcsuite.exe
- \\rport.exe
- \\rpwhostscr.exe
- \\rserver3.exe
- \\rudesktop*.exe
- \\rustdesk*.exe
- \\RustDesk.exe
- \\rutserv.exe
- \\rutview.exe
- \\rv.exe
- \\rvagent.exe
- \\rvagtray.exe
- \\RViewer.exe
- \\rxstartsupport.exe
- \\s3browser*.exe
- \\saazapsc.exe
- \\screenconnect*.exe
- \\ScreenConnect.ClientService.exe
- \\ScreenConnect.WindowsClient.exe
- \\ScreenMeet.Support.exe
- \\ScreenMeetSupport.exe
- \\SecureCRT.EXE
- \\seetrolcenter.exe
- \\seetrolclient.exe
- \\seetrolmyservice.exe
- \\seetrolremote.exe
- \\seetrolsetting.exe
- \\SensoClient.exe
- \\SensoService.exe
- \\sentinel-agent.exe
- \\servereye*.exe
- \\serverproxyservice.exe
- \\ServiceProxyLocalSys.exe
- \\SetMe_Client.exe
- \\showmypc*.exe
- \\showmypc.exe
- \\si.exe
- \\simplegatewayservice.exe
- \\simplehelpcustomer.exe
- \\simpleservice.exe
- \\Site24x7PluginAgent.exe
- \\Site24x7WindowsAgentTrayIcon.exe
- \\SmarTTY.exe
- \\SMPCSetup.exe
- \\softmon.exe
- \\Solar-PuTTY.exe
- \\SolarWinds-Dameware-DRS*.exe
- \\SolarWinds-Dameware-MRC*.exe
- \\Sorillus Launcher.exe
- \\Sorillus-Launcher*.exe
- \\Splashtop_Streamer_Windows*.exe
- \\SplashtopSOS.exe
- \\spsrv.exe
- \\sragent.exe
- \\SRManager.exe
- \\SRServer.exe
- \\srservice.exe
- \\STAHelper.exe
- \\strwinclt.exe
- \\StudentSvc.exe
- \\sunlogin*.exe
- \\superops.exe
- \\superopsticket.exe
- \\superputty.exe
- \\support-logmeinrescue*.exe
- \\support-logmeinrescue.exe
- \\SupportTool.exe
- \\supremo.exe
- \\supremohelper.exe
- \\supremoservice.exe
- \\SupremoSystem.exe
- \\svchost-windows-amd64-*.exe
- \\Syncro.App.Runner.exe
- \\Syncro.Installer.exe
- \\Syncro.Overmind.Service.exe
- \\Syncro.Service.exe
- \\SyncroLive.Agent.exe
- \\SyncroLive.Service.exe
- \\syncrosetup.exe
- \\Syncthing.exe
- \\sysdiag.exe
- \\syspectr.exe
- \\tacticalrmm.exe
- \\tailscale-*.exe
- \\tailscale-ipn.exe
- \\tailscaled.exe
- \\TakeControl.exe
- \\TaniumClient.exe
- \\TaniumCX.exe
- \\TaniumExecWrapper.exe
- \\TaniumFileInfo.exe
- \\TeamTaskManager.exe
- \\teamviewer_desktop.exe
- \\teamviewer_service.exe
- \\Teleport Connect Setup-*.exe
- \\TiAgent.exe
- \\TiClientCore.exe
- \\TiClientHelper*.exe
- \\TiExpertCore.exe
- \\TiExpertStandalone.exe
- \\tigervnc*.exe
- \\TightVNCViewerPortable*.exe
- \\tinUnattendedModule.exe
- \\TiService.exe
- \\TiUpdateService.exe
- \\tmagentsvc.exe
- \\tmcsvc.exe
- \\tniwinagent.exe
- \\todesk.exe
- \\ToDesk_Service.exe
- \\ToDesk_Setup.exe
- \\toolsiq.exe
- \\topiad.exe
- \\TPowerShell.exe
- \\TrustConnectAgent.exe
- \\TSClient.exe
- \\Tsdservice.exe
- \\tsircusr.exe
- \\turbomeeting.exe
- \\turbomeetingstarter.exe
- \\tvnserver.exe
- \\tvnviewer.exe
- \\ultimate_*.exe
- \\ultraviewer.exe
- \\UltraViewer_Desktop.exe
- \\UltraViewer_Service.exe
- \\UltraVNC*.exe
- \\Uninstall RemSupp.exe
- \\UniRMM.exe
- \\UserNotificationHelper.exe
- \\UVNC_Launch.exe
- \\veyon-master.exe
- \\veyon-server.exe
- \\veyon-service.exe
- \\veyon-wcli.exe
- \\veyon-worker.exe
- \\vhost.exe
- \\vncserver.exe
- \\vncserverui.exe
- \\vncviewer.exe
- \\webexpcnow.exe
- \\webrdp.exe
- \\wec_launcher_[a-Z0-9]*_.exe
- \\weCliboardListener.exe
- \\weezo setup*.exe
- \\weezo.exe
- \\weezohttpd.exe
- \\weInstSvc.exe
- \\wemonc.exe
- \\weprtct.exe
- \\wesvc.exe
- \\winagent.exe
- \\winaw32.exe
- \\windowslauncher.exe
- \\winpty-agent.exe
- \\winpty-agent64.exe
- \\WinSCP.exe
- \\winvnc*.exe
- \\winvnc.exe
- \\winvnc4.exe
- \\winvncsc.exe
- \\WinVNCStub.exe
- \\winwvc.exe
- \\wisshell*.exe
- \\wmc.exe
- \\wmc_deployer.exe
- \\wmcsvc.exe
- \\wysebrowser.exe
- \\xcmd.exe
- \\xcmdsvc.exe
- \\xeox-agent_*.exe
- \\xeox-agent_x64.exe
- \\xeox-agent_x86.exe
- \\xeox_service_windows.exe
- \\Xpra-Launcher.exe
- \\Xpra-x86_64_Setup.exe
- \\xShell.exe
- \\XSightService.exe
- \\YandexDisk2.exe
- \\ZA_Access.exe
- \\za_connect.exe
- \\zabbix_agent*.exe
- \\zaservice.exe
- \\ZecuritAgentAssetMgr.exe
- \\ZecuritAgentRegister.exe
- \\ZecuritAgentService.exe
- \\ZecuritAgentTray.exe
- \\ZecuritAgentUpgrader.exe
- \\ZecuritApplicationControlService.exe
- \\ZecuritCommandProcessor.exe
- \\ZecuritLiveNotifier.exe
- \\ZecuritRemoteTools.exe
- \\ZecuritScreenReaderApp.exe
- \\ZecuritScreenReaderAppUI.exe
- \\ZecuritScreenReaderService.exe
- \\zero-powershell.exe
- \\zerotier*.exe
- \\ZMAgent.exe
- \\zoc.exe
- \\ZohoMeeting.exe
- \\zohotray.exe
- \\Zohours.exe
- \\ZohoURSService.exe
- C:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe
- C:\\Program Files\\Monitic\\agent.exe
- C:\\Users\\*\\AppData\\Local\\remsupp-updater\\installer.exe
condition: selection
falsepositives:
- Legitimate usage of remote management tools
level: medium
View DNS detection rule
title: DNS Queries to Known RMM Domains
id: 9fa68c28-79b2-4ab5-af95-0c7b2f706c63
status: experimental
description: Detects DNS queries to known Remote Monitoring and Management (RMM) tool
domains that could indicate unauthorized remote access
references:
- https://github.com/magicsword-io/LOLRMM
author: LOLRMM Project
date: '2025-03-18'
modified: '2026-10-05'
tags:
- attack.command-and-control
- attack.t1219
logsource:
category: dns
product: any
detection:
selection:
query|contains:
- .*.-dms.zoho.com.cn
- .*.01com.com
- .*.247ithelp.com
- .*.action1.com
- .*.adobeconnect.com
- .*.alpemix.com
- .*.ammyy.com
- .*.analytics.insight.rapid7.com
- .*.anysupport.net
- .*.anyviewer.com
- .*.aomeisoftware.com
- .*.api.jumpcloud.com
- .*.api.netreo.com
- .*.api.splashtop.com
- .*.api.splashtop.eu
- .*.assist.jumpcloud.com
- .*.auvik.com
- .*.baramundi.com
- .*.beamyourscreen.com
- .*.beanywhere.com
- .*.beinsync.com
- .*.beinsync.net
- .*.beyondtrustcloud.com
- .*.bluetrait.io
- .*.bomgarcloud.com
- .*.cc.centrastage.net
- .*.cdn.getgo.com
- .*.cell-1.domotz.com
- .*.cfargotunnel.com
- .*.cloud.tanium.com
- .*.cloudbackup.management
- .*.cloudberrylab.com
- .*.cmdm.comodo.com
- .*.connect.backdrop.cloud
- .*.connectwise.com
- .*.content.rview.com
- .*.crossloop.com
- .*.dataplicity.com
- .*.deskroll.com
- .*.desktop.qq.com
- .*.desktopstreaming.com
- .*.devtunnels.ms
- .*.distantdesktop.com
- .*.dms.zoho.com
- .*.dms.zoho.com.eu
- .*.domotz.co
- .*.duetdisplay.com
- .*.dwservice.net
- .*.endpoint.ingress.rapid7.com
- .*.ezhelp.co.kr
- .*.fastsupport.com
- .*.fastviewer.com
- .*.fdcollab.com
- .*.fixme.it
- .*.fleetdeck.io
- .*.freshchat.com
- .*.freshcloud.io
- .*.freshconnect.io
- .*.freshdev.io
- .*.freshservice.com
- .*.freshworks.com
- .*.freshworksapi.com
- .*.gatherplace.com
- .*.gatherplace.net
- .*.getgo.com
- .*.getscreen.me
- .*.gotoassist.at
- .*.gotoassist.com
- .*.gotoassist.me
- .*.gotohttp.com
- .*.GoToMyPC.com
- .*.heartbeatrm.com
- .*.helpu.co.kr
- .*.hostedrmm.com
- .*.idrive.com
- .*.immy.bot
- .*.in-freshbots.ai
- .*.instanthousecall.com
- .*.instanthousecall.net
- .*.intelliadmin.com
- .*.internetid.ru
- .*.invgate.net
- .*.iperius-rs.com
- .*.iperius.com
- .*.iperiusremote.com
- .*.islonline.com
- .*.islonline.net
- .*.itagent.com
- .*.itsm-us1.comodo.com
- .*.itsupport247.net
- .*.ivanti.com
- .*.ivanticloud.com
- .*.jumpdesktop.com
- .*.jumpto.me
- .*.kabuto.io
- .*.kabutoservices.com
- .*.kace.com
- .*.kaseya.net
- .*.khelpdesk.com.br
- .*.level.io
- .*.litemanager.com
- .*.litemanager.ru
- .*.localxpose.io
- .*.logicnow.com
- .*.logmein.com
- .*.logmein.eu
- .*.logmeininc.com
- .*.logmeinrescue.com
- .*.logmeinrescue.eu
- .*.lunixar.com
- .*.managedsupport.kaseya.net
- .*.manageengine.com
- .*.mdmsupport.comodo.com
- .*.mdt.qq.com
- .*.mikogo.com
- .*.mikogo4.com
- .*.miradore.com
- .*.msp360.com
- .*.mspbackups.com
- .*.my.auvik.com
- .*.myfreshworks.com
- .*.mygreenpc.com
- .*.n-able.com
- .*.nchuser.com
- .*.net.anydesk.com
- .*.netbird.io
- .*.netop.com
- .*.netsupportmanager.com
- .*.netviewer.com
- .*.ngrok-free.app
- .*.ngrok.app
- .*.ngrok.com
- .*.ngrok.dev
- .*.ngrok.io
- .*.ngrok.pizza
- .*.ngrok.pro
- .*.ninite.com
- .*.ninja-backup.com
- .*.ninjaone.com
- .*.ninjarmm.com
- .*.ninjarmm.net
- .*.ntrsupport.com
- .*.nvaccess.org
- .*.opti-tune.com
- .*.optitune.us
- .*.parallels.com
- .*.parsec.app
- .*.pcvisit.de
- .*.pilixo.com
- .*.pitunnel.com
- .*.prd.cdo.system-monitor.com
- .*.real-time-collaboration.com
- .*.rel.tunnels.api.visualstudio.com
- .*.relay.splashtop.com
- .*.remmon.hu
- .*.remote.management
- .*.remotecall.com
- .*.remotedesktop-pa.googleapis.com
- .*.remotedesktop.com
- .*.remotedesktop.google.com
- .*.remotepc.com
- .*.rmm.datto.com
- .*.rmmservice.ca
- .*.rmmservice.com.au
- .*.rmmservice.eu
- .*.rtschannel.com
- .*.rudesktop.ru
- .*.rview.com
- .*.screenconnect.com
- .*.screenmeet.com
- .*.scrn.mt
- .*.search.namequery.com
- .*.senso.cloud
- .*.server-eye.de
- .*.server.absolute.com
- .*.set.me
- .*.shellhub.io
- .*.showmypc.com
- .*.signalserver.xyz
- .*.sophos.com
- .*.sophosupd.com
- .*.sophosupd.net
- .*.sorillus.com
- .*.soti.net
- .*.splashtop.com
- .*.spytech-web.com
- .*.startsupport.com
- .*.superops.ai
- .*.superopsalpha.com
- .*.superopsbeta.com
- .*.support.services.microsoft.com
- .*.supremocontrol.com
- .*.swi-tc.com
- .*.syncroapi.com
- .*.syncromsp.com
- .*.syspectr.com
- .*.system-monitor.com
- .*.systemmonitor.co.uk
- .*.systemmonitor.eu.com
- .*.systemmonitor.us
- .*.tailscale.com
- .*.tailscale.io
- .*.teamviewer.com
- .*.techinline.net
- .*.teknopars.com
- .*.teleport.sh
- .*.teramind.co
- .*.tiflux.com
- .*.tmate.io
- .*.todesk.com
- .*.trycloudflare.com
- .*.ultraviewer.net
- .*.vicarius.cloud
- .*.webpush.freshchat.com
- .*.weezo.me
- .*.weezo.net
- .*.wormhole.dataplicity.com
- .*.xeox.com
- .*.zerotier.com
- .*.zoho.com
- .*.zoho.com.au
- .*.zoho.com.cn
- .*.zoho.eu
- .*.zoho.in
- .*.zohoassist.com
- .*.zohoassist.com.cn
- .*.zohoassist.jp
- .136.243.104.235
- .136.243.104.242
- .136.243.18.122
- .160.191.182.41
- .192.144.34.42
- .192.3.95.152
- .198.46.178.135
- .1wuccjc4a3.execute-api.eu-west-1.amazonaws.com
- .29qoj3q0yf.execute-api.us-west-2.amazonaws.com
- .51.255.19.178
- .51.255.19.179
- .8z5x4rqbxi.execute-api.eu-west-1.amazonaws.com
- ._v2-origintunneld._tcp.argotunnel.com
- .a1-backend-packages.s3.amazonaws.com
- .a33d8yamkwy4nx-ats.iot.ap-southeast-2.amazonaws.com
- .a33d8yamkwy4nx-ats.iot.eu-central-1.amazonaws.com
- .a33d8yamkwy4nx-ats.iot.eu-west-1.amazonaws.com
- .a33d8yamkwy4nx-ats.iot.us-west-2.amazonaws.com
- .account.flexihub.com
- .activation.netreo.net
- .aeroadmin.com
- .agent-api.atera.com
- .agent.tiflux.com
- .agenthb.atera.com
- .agentmqtt.fleetdeck.io
- .agentreporting.atera.com
- .agentreportingstore.blob.core.windows.net
- .agents*-cloud.acronis.com
- .agents.addigy.com
- .agents.level.io
- .ammyy.com
- .anyplace-control.com
- .api-ca-1.lavawall.com
- .api.allocentra.co.za
- .api.cloudflare.com
- .api.fdcollab.com
- .api.helpwire.app
- .api.hoptodesk.com
- .api.idrive.com
- .api.localxpose.io
- .api.monitic.com
- .api.mremote.io
- .api.netbird.io
- .api.remote.it
- .api.remsupp.com
- .api.rg-supervision.com
- .api.rmmmax.com
- .api.rustdesk.com
- .apicdn-wchat.freshchat.com
- .app-af-agent-prod-009.azurewebsites.net
- .app.atera.com
- .app.deskday.ai
- .app.gorelo.io
- .app.kabuto.io
- .app.lunixar.com
- .app.monitic.com
- .app.netbird.io
- .app.pdq.com
- .app.tiflux.com
- .app.zecurit.com
- .appcdn.atera.com
- .asapi*.aweray.net
- .assist.zoho.com
- .atera-agent-heartbeat.servicebus.windows.net
- .atera.pubnubapi.com
- .atled.syspectr.com
- .attachments.servably.com
- .auth*.aeroadmin.com
- .auth.api.remote.it
- .auvik.com
- .barracudamsp.com
- .basecamp.com
- .beamyourscreen.com
- .beanywhere.com
- .blackcryptknight.com
- .bluetrait.io
- .bomgarcloud.com
- .boot.net.anydesk.com
- .breeze.app
- .breezermm.com
- .builds.level.io
- .c.mid.al
- .caremote1.lavawall.com
- .cc.centrastage.net
- .cdn.teleport.dev
- .cell-1.domotz.com
- .centuriontech.com
- .cfcdn.pdq.com
- .cftunnel.com
- .changes.panorama9.com
- .charon.netreo.net
- .checkip.zmazonaws.com
- .chromoting-client.talkgadget.google.com
- .chromoting-host.talkgadget.google.com
- .chromoting-oauth.talkgadget.google.com
- .client-api.aweray.com
- .client.oray.net
- .client.teamviewer.com
- .cloud-233f9.firebaseapp.com
- .cloud-ed980.firebaseapp.com
- .cloud.acronis.com
- .cloud.faronics.com
- .cloud.shellhub.io
- .cloud.tanium.com
- .cloudbackup.management
- .comserver.eu1.mspa.n-able.com
- .comserver.global.mspa.n-able.com
- .comserver.us1.mspa.n-able.com
- .comserver.us2.mspa.n-able.com
- .connect.acronis.com
- .connect.ap.ngrok-agent.com
- .connect.au.ngrok-agent.com
- .connect.eu.ngrok-agent.com
- .connect.in.ngrok-agent.com
- .connect.jp.ngrok-agent.com
- .connect.ngrok-agent.com
- .connect.sa.ngrok-agent.com
- .connect.us.ngrok-agent.com
- .connectwise.com
- .content.rview.com
- .control.connectwise.com
- .crossloop.en.softonic.com
- .d1m8kha1zyjal6.cloudfront.net
- .dameware.com
- .dashboard.rg-supervision.com
- .dataplicity.com
- .deepfreeze.com
- .demo.controlr.app
- .deploy.faronics.com
- .deploy01.kaseya.com
- .deskday.ai
- .deskroll.com
- .desktopcentral.manageengine.cn
- .desktopcentral.manageengine.com
- .desktopcentral.manageengine.com.eu
- .devapi.monitic.com
- .devrmm.lunixar.com
- .dms.zecurit.com
- .docs.baramundi.com
- .docs.faronics.com
- .docs.invgate.net
- .docs.tacticalrmm.com
- .domotz.com
- .donkz.nl
- .download.hoptodesk.com
- .download.pilixo.com
- .download.remsupp.com
- .downloads.level.io
- .downloads.lunixar.com
- .downloads.vector-networks.com
- .downloads.zohocdn.com
- .downloads.zohodl.com.cn
- .dronemaker.org
- .duetdisplay.com
- .eb.ap-southeast-2.prd.davinci.system-monitor.com
- .eb.eu-central-1.prd.davinci.system-monitor.com
- .eb.eu-west-1.prd.davinci.system-monitor.com
- .eb.us-west-2.prd.davinci.system-monitor.com
- .ehorus.com
- .electric.ai
- .emcosoftware.com
- .encapto.com
- .ericom.com
- .eu.2breeze.app
- .everywhere.laplink.com
- .ezhelp.co.kr
- .faronics-deploy-int-production-installers.s3.eu-west-1.amazonaws.com
- .faronics-deploy-na-production-installers.s3.us-west-2.amazonaws.com
- .faronics.com
- .faronicscloud.com
- .fastviewer.com
- .feeds.n-able.com
- .fixme.it
- .fleetdeck.io
- .fortra.com
- .forum.glpi-project.org
- .freshasset.com
- .freshservice.com
- .fstools.freshasset.com
- .fstools.freshservice.com
- .gateway.miradore.com
- .gateway.zohoassist.com
- .gatherplace.com
- .gd.bj2.xyz
- .geo.netsupportsoftware.com
- .gerwconline.blob.core.windows.net
- .get.helpwire.app
- .getalphacontrol.com
- .GetScreen.me
- .ghcr.io
- .github.com
- .global.rel.tunnels.api.visualstudio.com
- .glpi-network.com
- .glpi-project.org
- .go.getscreen.me
- .googl-165a0.web.app
- .googl-6c11f.firebaseapp.com
- .googl-6c11f.web.app
- .gorelo-rmm.azurewebsites.net
- .goto.com
- .gotohttp.com
- .goverlan.com
- .grtmprod.addigy.com
- .guacamole.apache.org
- .gw.remotix.com
- .gw.usw.gorelo.tech
- .h2.cftunnel.com
- .heartbeatrm.com
- .help.invgate.com
- .helpbeam.software.informer.com
- .helpme.net
- .helpu.co.kr
- .helpwire.app
- .hoptodesk.com
- .idrive.com
- .image.getscreen.me
- .immy.bot
- .imperosoftware.com
- .instance-*-relay.screenconnect.com
- .instances-info.invgate.com
- .instances-list.invgate.com
- .instanthousecall.com
- .invgate.com
- .invgate.net
- .iperiusremote.com
- .islonline.com
- .isodownload.baramundi.com
- .itagent.com
- .itsupport247.net
- .ivanti.com
- .jumpdesktop.com
- .jumpto.me
- .kabuto.io
- .kabutoservices.com
- .kaseya.com
- .kickidler.com
- .komari-document.pages.dev
- .lavawinupdate.lavawall.com
- .lb-insight-001.invgate.net
- .ld.aurelius.host
- .le.laplink.com
- .level.io
- .light-rmm-monitor-20260825.azurewebsites.net
- .lisa.rg-supervision.com
- .litemanager.com
- .live.screenconnect.com
- .localxpose.io
- .logicnow.com
- .login.netbird.io
- .login.tailscale.com
- .logmein-gateway.com
- .logmeinrescue.com
- .lr.rmm.pod1.usw.gorelo.tech
- .lunixar.com
- .mail.metaquest.com
- .managedsupport.kaseya.net
- .manageengine.com
- .mdmsupport.comodo.com
- .meshcentral.com
- .metaquest.com
- .microuptime.com
- .mikogo.com
- .miradore.com
- .monitic.com
- .mremoteng.org
- .msp360.com
- .my-sharepoint-inc.com
- .my.kickidler.com
- .my.splashtop.com
- .my1cloudlive.com
- .my2cloudlive.com
- .mygreenpc.com
- .myivo-server.software.informer.com
- .mymeetinggoogle.com
- .n-able.com
- .naverisk.com
- .netbird.io
- .netreo.com
- .netsupportmanager.com
- .neturo.uplus.co.kr
- .netviewer.com
- .networkservice.cyou
- .nezha.wiki
- .nezhahq.github.io
- .ngrok.com
- .nightly.glpi-project.org
- .ninite.com
- .ninja-backup.com
- .ninjaone.com
- .ninjarmm.net
- .nomachine.com
- .nv0mddxkh7.execute-api.us-west-2.amazonaws.com
- .nvaccess.org
- .objects.githubusercontent.com
- .ocsinventory-ng.org
- .one.comodo.com
- .online.level.io
- .opsbridge.digital
- .packagesstore.blob.core.windows.net
- .pandoramods.top
- .panorama9.com
- .parsec.app
- .parsec.gg
- .pcvisit.de
- .pdqinstallers.*.r2.cloudflarestorage.com
- .pilixo.com
- .pitunnel.com
- .pkgs.netbird.io
- .plus*.site24x7.cn
- .plus*.site24x7.com
- .plus*.site24x7.eu
- .plus*.site24x7.in
- .plus*.site24x7.net.au
- .portal.ehorus.com
- .prod.addigy.com
- .ps.atera.com
- .public.rmm.pod1.usw.gorelo.tech
- .pubsub.atera.com
- .pulseway.com
- .px-*.getscreen.me
- .qq-messenger.en.softonic.com
- .quic.cftunnel.com
- .r1.rmm.uw.gorelo.tech
- .radmin.com
- .raw.githubusercontent.com
- .rdp.duetdisplay.com
- .region1.v2.argotunnel.com
- .region2.v2.argotunnel.com
- .relay-*.net.anydesk.com
- .relay.netbird.io
- .releases.invgate.com
- .releases.n-able.com
- .remmon.hu
- .remobo.en.softonic.com
- .remote.it
- .remote.management
- .remoteaccess.itarian.com
- .remotecall.com
- .remotedesktop-pa.googleapis.com
- .remotedesktop.google.com
- .remotepass.com
- .remotepc.com
- .remotepro-ap-southeast-1.faronicsdeploy.com
- .remotepro-ca-central-1.faronics.com
- .remotepro-eu-west-1.faronicsdeploy.com
- .remotepro-sa-east-1.faronicsdeploy.com
- .remotepro-us-east-1.faronics.com
- .remotepro-us-west-2.faronics.com
- .remotepulse.io
- .remoteutilities.com
- .repairshopr.com
- .reporting-connect.teleportinfra.sh
- .rescue-data-cetner.logmein-gateway.com
- .rescue-list.*.logmein-gateway.com
- .resources.ninjarmm.com
- .rism.pages.dev
- .rmansys.ru
- .rmm.barracudamsp.com
- .rmmservice.ca
- .rmmservice.com.au
- .rmmservice.eu
- .rodex.cc
- .router15.teamviewer.com
- .royalapps.com
- .rport.io
- .rs-ny.rustdesk.com
- .rt.teramind.co
- .rudesktop.ru
- .runsmart.io
- .rustdesk.com
- .savaliyapriyal874-code.github.io
- .search.namequery.com
- .secure.instanthousecall.com
- .seetrol.co.kr
- .senso.cloud
- .sentry.dev.teramind.co
- .serv.superopsalpha.com
- .servably.com
- .server.absolute.com
- .servicedesk.itarian.com
- .services.glpi-network.com
- .set.me
- .shellhub.io
- .showmypc.com
- .signal.hoptodesk.com
- .signal.netbird.io
- .signalserver.xyz
- .simple-help.com
- .sis.n-able.com
- .skyfex.com
- .socket.lunixar.com
- .softbymade.top
- .sorillus.com
- .soti.net
- .splashtop.com
- .spyanywhere.com
- .sr.rmm.pod1.usw.gorelo.tech
- .staging.helpwire.app
- .static.freshdev.io
- .stun.helpwire.app
- .stunserver.stunprotocol.org
- .sunlogin.oray.com
- .superops.ai
- .support.faronics.com
- .swi-rc.cdn-sw.net
- .syncromsp.com
- .syspectr.com
- .system-monitor.com
- .systemmonitor.co.uk
- .systemmonitor.eu.com
- .systemmonitor.us
- .systemmonitor.us.cdn.cloudflare.net
- .taf.teamviewer.com
- .tailscale.com
- .tele-desk.com
- .telesupportgroup.com
- .teramind.co
- .tiflux.com
- .tiflux.com.br
- .tightvnc.com
- .tmate.io
- .todesk.com
- .trust-access.invgate.com
- .trust.invgate.com
- .trustconnectsoftware.com
- .trusted.panorama9.com
- .turn.hoptodesk.com
- .turn.monitic.com
- .ultraviewer.net
- .ultravnc.com
- .upd.faronicslabs.com
- .update.argotunnel.com
- .update.n-able.com
- .upload_data.qq.com
- .us-region1.v2.argotunnel.com
- .us-region2.v2.argotunnel.com
- .us.2breeze.app
- .usage.teleport.dev
- .vector-networks.com
- .vicarius-ap-southeast-3-installer.s3.amazonaws.com
- .vicarius-ap-southeast-3-installer.s3.ap-southeast-3.amazonaws.com
- .vicarius-ap-southeast-3-patches.s3.amazonaws.com
- .vicarius-ap-southeast-3-patches.s3.ap-southeast-3.amazonaws.com
- .vicarius-ap-southeast-3-release.s3.amazonaws.com
- .vicarius-ap-southeast-3-release.s3.ap-southeast-3.amazonaws.com
- .vicarius-eu-central-1-installer.s3.amazonaws.com
- .vicarius-eu-central-1-installer.s3.eu-central-1.amazonaws.com
- .vicarius-eu-central-1-patches.s3.amazonaws.com
- .vicarius-eu-central-1-patches.s3.eu-central-1.amazonaws.com
- .vicarius-eu-central-1-release.s3.amazonaws.com
- .vicarius-eu-central-1-release.s3.eu-central-1.amazonaws.com
- .vicarius-installer.s3.amazonaws.com
- .vicarius-patches.s3.amazonaws.com
- .vicarius-release.s3.amazonaws.com
- .vicarius-release.s3.us-east-1.amazonaws.com
- .vicarius-static-organizationinstallations.vicarius-cdn.com
- .vizor.cloud
- .wangwang.taobao.com
- .web-16fe.app
- .web.rustdesk.com
- .webserv.logistical-software.co.uk
- .weezo.en.softonic.com
- .weezo.net
- .www.baramundi.com
- .www.dataplicity.com
- .www.deepfreeze.com
- .www.faronics.com
- .www.faronicsdeploy.com
- .www.freshservice.com
- .www.glpi-project.org
- .www.hoptodesk.com
- .www.invgate.com
- .www.komari.wiki
- .www.logistical-software.co.uk
- .www.metaquest.com
- .www.monitic.com
- .www.pitunnel.com
- .www.remotepc.com
- .www.remotepulse.io
- .www.rodex.cc
- .www.shellhub.io
- .www.teramind.co
- .www.tiflux.com
- .www.tiflux.com.br
- .www.vector-networks.com
- .www.vizor.cloud
- .xeox.com
- .zabbix.com
- .zerotier.com
filter:
query|contains: your-approved-rmm.com
condition: selection and not filter
falsepositives:
- Legitimate usage of approved remote management tools
level: medium
Community Sysmon configuration
Dodge This Security maintains a Sysmon configuration for hunting RMM activity using LOLRMM intelligence.
Explore Sysmon-LOLRMM ↗