RMM
Connectwise Automate (LabTech)
Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2025-12-14
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
ltsvc.exe
ltsvcmon.exe
lttray.exe
Code signing
- signer name
- ConnectWise\
- issuer
- CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
- certificate thumbprint
- DC69069188D5CBC5FE18B7D035C90061C8741E21
- tbs sha256
- EE87E0B6968C49806887874C952D0F6C1DAABA50D699FE8C5524103D7A3A82D1
- tbs sha1
- 8A97D01B55E4A964BC3379B13A5C8FF616756F98
- valid from
- 2025-06-18T00:00:00+00:00
- valid to
- 2028-06-20T23:59:59+00:00
- signer name
- Connectwise\
- issuer
- CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
- certificate thumbprint
- FF8BFAFA697459874FB9843B1EFDA5C91871A44C
- tbs sha256
- 46135C0D0BC2714588E2E99AEB2BBC714F972F50D46C4C6D084F9D9CF9E485A4
- tbs sha1
- 8FA64999CB0CB343856CECBA0F7475CD2079B01B
- valid from
- 2022-07-13T00:00:00+00:00
- valid to
- 2025-07-12T23:59:59+00:00
- signer name
- ConnectWise\
- issuer
- CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3
- certificate thumbprint
- 07290735CAC17E851C608F28C3C03F68B94DDC35
- tbs sha256
- 2536E3C682B73B99B516CDEEE24FCB828C84CBDA003E3C3075CA771717B4CEBA
- tbs sha1
- 50795CA816F444E2EF35E42C95AFC0AD99633491
- valid from
- 2019-01-11T20:03:41+00:00
- valid to
- 2022-04-07T21:58:55+00:00
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 70644D15A9833AE7E85FCC0D2146831978BEEFF4
- src file sha256
- 532d20a37c6493fae3144fa8aae0a2c3510f6bdc0a2683e9ce7970d6a22d65c2
- src file path
- downloaded_files/connectwise_automate_(labtech)/532d20a37c6493fae3144fa8aae0a2c3510f6bdc0a2683e9ce7970d6a22d65c2
- src file company
- LabTech Software
search names
ltsvc.exe
ltsvcmon.exe
lttray.exe
company names
signer names
ConnectWise\
Connectwise\
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- *.hostedrmm.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/connectwise_automate__labtech__network_sigma.yml
- Description
- Detects potential network activity of Connectwise Automate (LabTech) RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/connectwise_automate__labtech__processes_sigma.yml
- Description
- Detects potential processes activity of Connectwise Automate (LabTech) RMM tool