RMM
ConnectWise Control
ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2025-12-14
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
connectwisechat-customer.exe
connectwisecontrol.client.exe
screenconnect.windowsclient.exe
Code signing
- signer name
- ConnectWise, Inc.
- certificate thumbprint
- 07290735CAC17E851C608F28C3C03F68B94DDC35
- tbs sha256
- 2536E3C682B73B99B516CDEEE24FCB828C84CBDA003E3C3075CA771717B4CEBA
- tbs sha1
- Not recorded
- signer name
- Connectwise, LLC
- certificate thumbprint
- FF8BFAFA697459874FB9843B1EFDA5C91871A44C
- tbs sha256
- 46135C0D0BC2714588E2E99AEB2BBC714F972F50D46C4C6D084F9D9CF9E485A4
- tbs sha1
- Not recorded
- signer name
- ConnectWise, LLC
- certificate thumbprint
- DC69069188D5CBC5FE18B7D035C90061C8741E21
- tbs sha256
- EE87E0B6968C49806887874C952D0F6C1DAABA50D699FE8C5524103D7A3A82D1
- tbs sha1
- Not recorded
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 5C58CEA4608461C9A4188F480466123A9DD02431
- src file sha256
- a5c8ede4d24165797dcfbabbb85f62c44a79b058381e68249bf418a01fc67a1d
- src file path
- downloaded_files/connectwise_control/a5c8ede4d24165797dcfbabbb85f62c44a79b058381e68249bf418a01fc67a1d
- src file company
- ScreenConnect Software
- signer name
- ConnectWise, LLC
- certificate thumbprint
- DD631BF0A610530A2C8C93B35609054E34FF5F70
- src file sha256
- c218eb4c68fafc90f1f9dde973ea85184c5a7cb830af174285d8b9e6ce6e1d06
- src file path
- downloaded_files/connectwise_control/c218eb4c68fafc90f1f9dde973ea85184c5a7cb830af174285d8b9e6ce6e1d06
- src file company
- ScreenConnect Software
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 11C81879E141A8407D461ADB14EF568A58022BEC
- src file sha256
- ee0fd474de7eb1b844ec8359a4453bfb56263191643c03919bd05f439761c722
- src file path
- downloaded_files/connectwise_control/ee0fd474de7eb1b844ec8359a4453bfb56263191643c03919bd05f439761c722
- src file company
- ScreenConnect Software
- signer name
- ConnectWise, LLC
- certificate thumbprint
- F307637A290C1BCDCCC4437A58DE17C0BDBFC830
- src file sha256
- c79526ce6eed74a509c7192decb2ce8988578cdbe3400c68b66395f9c2941e40
- src file path
- downloaded_files/connectwise_control/c79526ce6eed74a509c7192decb2ce8988578cdbe3400c68b66395f9c2941e40
- src file company
- ScreenConnect Software
search names
company names
signer names
ConnectWise, Inc.
ConnectWise, LLC
Connectwise, LLC
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- live.screenconnect.com
- control.connectwise.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/connectwise_control_network_sigma.yml
- Description
- Detects potential network activity of ConnectWise Control RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/connectwise_control_processes_sigma.yml
- Description
- Detects potential processes activity of ConnectWise Control RMM tool