RMM
Faronics Deploy
Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session ("Remote Pro"). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution.
Tool overview
- Category
- RMM
- Research authors
- @MHaggis
- Created
- 2026-05-04
- Last modified
- 2026-09-07
- Privileges
- SYSTEM
- Free / availability
- 30 day trial
- Verification required
- Signed - 'Faronics Corporation' (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 / DigiCert SHA2 Assured ID Code Signing CA)
- Supported platforms
Windows
macOS
Capabilities
Executables & installation paths
- Filename
- FaronicsDeployAgent.exe
- OriginalFileName
- FaronicsDeployAgent.exe
- Description
- Faronics Deploy Agent (full installer)
- Filename
- FWAService.exe
- OriginalFileName
- FWAService.exe
- Description
- Faronics Deploy / Cloud Agent service host (FWASvc)
- Filename
- FWA_UI_Agent.exe
- OriginalFileName
- FWA_UI_Agent.exe
- Description
- Faronics Deploy user-interface agent
- Filename
- FRCServer.exe
- OriginalFileName
- FRCServer.exe
- Description
- Faronics Remote Control server component
- Filename
- FaronicsSA.exe
- OriginalFileName
- FaronicsSA.exe
- Description
- Faronics Standalone helper
- Filename
- FSSInstaller.exe
- OriginalFileName
- FSSInstaller.exe
- Description
- Faronics Storage Spaces installer
- Filename
- NotificationHelper.exe
- OriginalFileName
- NotificationHelper.exe
- Description
- Faronics Deploy notification helper
- Filename
- ModulesUpgradeMgr.exe
- OriginalFileName
- ModulesUpgradeMgr.exe
- Description
- Faronics Deploy module upgrade manager
Installation paths
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\*
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsDeployAgent.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsSA.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FSSInstaller.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\ModulesUpgradeMgr.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\NotificationHelper.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\UserNotificationHelper.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_32.exe
C:\Program Files (x86)\Faronics\Faronics Deploy Agent\MigrationHelper_64.exe
C:\ProgramData\Faronics\StorageSpace\FWA\*
FaronicsDeployAgent.exe
FWAWebInstaller_*.exe
FWAService.exe
FWA_UI_Agent.exe
CloudWksInstall.exe
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FaronicsDeployAgent.exe
- Description
- Faronics Deploy Agent main executable
- OS
- Windows
- File
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe
- Description
- Faronics Deploy Cloud Agent service (registered as FWASvc)
- OS
- Windows
- File
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWA_UI_Agent.exe
- Description
- Faronics Deploy user-interface agent
- OS
- Windows
- File
- C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FRCServer.exe
- Description
- Faronics Remote Control server component
- OS
- Windows
- File
- C:\ProgramData\Faronics\StorageSpace\FWA\CloudAgentLogs.LOG
- Description
- Faronics Deploy / Cloud Agent activity log
- OS
- Windows
- File
- C:\ProgramData\Faronics\StorageSpace\FWA\Logs\FWASvc.log
- Description
- Faronics Deploy service log (FWASvc)
- OS
- Windows
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 7045
- ProviderName
- Service Control Manager
- LogFile
- System.evtx
- ServiceName
- FWASvc
- ImagePath
- "C:\Program Files (x86)\Faronics\Faronics Deploy Agent\FWAService.exe"
- Description
- Service installation event for the Faronics Deploy / Cloud Agent service.
FORENSIC EVIDENCE
Registry artifacts
- Path
- HKLM\SOFTWARE\Faronics
- Description
- Top-level Faronics product registry hive (shared with other Faronics products; presence of Faronics Deploy subkeys confirms install)
- Path
- HKLM\SOFTWARE\WOW6432Node\Faronics\Faronics Core 3\Storage Spaces\Spaces\FWA
- Description
- Faronics Deploy / Cloud Agent storage-space configuration
- Path
- HKLM\SOFTWARE\Classes\AppID\FWAService.exe
- Description
- COM AppID registration for the FWAService.exe service host
- Path
- HKLM\SOFTWARE\Classes\{359C24F1-51B5-44CE-8F2D-2FBB1A0FE4EA}\FWA_GUI_Agent
- Description
- COM CLSID for the Faronics Deploy GUI agent (FWA_GUI_Agent)
- Path
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{581F69E6-A5D1-48C7-9F6F-CC333007F7EB}
- Description
- Faronics Deploy Agent uninstall entry
FORENSIC EVIDENCE
Network artifacts
- Description
- Faronics Deploy console / endpoint sign-up (web)
- Domains
- deploy.faronics.com
- www.faronicsdeploy.com
- faronicscloud.com
- Ports
- 443
- Description
- Faronics Deploy / Cloud agent management API (AWS API Gateway, us-west-2 and eu-west-1)
- Domains
- nv0mddxkh7.execute-api.us-west-2.amazonaws.com
- 29qoj3q0yf.execute-api.us-west-2.amazonaws.com
- 8z5x4rqbxi.execute-api.eu-west-1.amazonaws.com
- 1wuccjc4a3.execute-api.eu-west-1.amazonaws.com
- Ports
- 443
- Description
- Faronics Deploy installer / artifact storage (S3, us-west-2 and eu-west-1)
- Domains
- faronics-deploy-na-production-installers.s3.us-west-2.amazonaws.com
- faronics-deploy-int-production-installers.s3.eu-west-1.amazonaws.com
- Ports
- 443
- Description
- Faronics Deploy Remote Pro browser-based remote-control regional endpoints
- Domains
- remotepro-us-west-2.faronics.com
- remotepro-us-east-1.faronics.com
- remotepro-ca-central-1.faronics.com
- remotepro-eu-west-1.faronicsdeploy.com
- remotepro-ap-southeast-1.faronicsdeploy.com
- remotepro-sa-east-1.faronicsdeploy.com
- Ports
- 443
- Description
- Faronics support / corporate domains contacted by signed agent binaries
- Domains
- faronics.com
- support.faronics.com
- docs.faronics.com
- upd.faronicslabs.com
- Ports
- 443
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/faronics_deploy_files_sigma.yml
- Description
- Detects potential files activity of Faronics Deploy RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/faronics_deploy_network_sigma.yml
- Description
- Detects potential network activity of Faronics Deploy RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/faronics_deploy_processes_sigma.yml
- Description
- Detects potential processes activity of Faronics Deploy RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/faronics_deploy_registry_sigma.yml
- Description
- Detects potential registry activity of Faronics Deploy RMM tool
References
- https://www.faronics.com/products/deploy
- https://docs.faronics.com/faronicsdeploy
- https://docs.faronics.com/faronicsdeploy/get-started-1/quick-start/pre-requisites/install-deploy-agents/windows-install-guide
- https://support.faronics.com/help/en-ca/6-faronics-deploy/77-what-port-numbers-and-host-names-are-used-by-faronics-deploy
- https://www.faronics.com/deploy/remote-control
- https://www.virustotal.com/gui/file/b38229e9ce3a249ff7ac06ee9158e744c023338b570ffaf9bed8fc9b94b944f4
- https://www.virustotal.com/gui/file/eee04dd4e7dd58d33ffb503686cdac07f88f8bea7bb29dbcd48d6715c198cea9
- https://www.huntress.com/blog/faronics-deploy-abuse
- https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/
Acknowledgements
- Person
- cbecks2
- Handle
- cbecks2
- Person
- Michael Haag
- Handle
- @MHaggis
- Person
- Liran Ravich
- Hadnle
- Liran017