RMM
FleetDeck.io
FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations.
Tool overview
- Category
- RMM
- Research authors
- Michael Haag
- Created
- 2026-01-15
- Last modified
- 2026-01-15
- Privileges
- SYSTEM
- Free / availability
- Trial and Paid
- Verification required
- Code-signed
- Supported platforms
Windows
Capabilities
Executables & installation paths
- Filename
- fleetdeck-agent.exe
- OriginalFileName
- fleetdeck_installer
- Description
- FleetDeck agent installer (verified via official documentation)
- Filename
- fleetdeck_agent_svc.exe
- OriginalFileName
- Not recorded
- Description
- FleetDeck agent service executable (verified via official documentation)
- Filename
- fleetdeck-agent.msi
- OriginalFileName
- Not recorded
- Description
- FleetDeck MSI installer (verified via official documentation)
- Filename
- fd_agent.dll
- OriginalFileName
- Not recorded
- Description
- FleetDeck agent DLL component (reported in GitHub issue)
Installation paths
C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
C:\Program Files (x86)\FleetDeck Agent\*\fleetdeck_agent.exe
C:\Program Files (x86)\FleetDeck Agent\*\fd_agent.dll
C:\Windows\Temp\FleetDeck\*
fleetdeck-agent.exe
fleetdeck_agent_svc.exe
fleetdeck_commander_svc.exe
fleetdeck_installer.exe
fleetdeck_commander_launcher.exe
fleetdeck_agent.exe
fleetdeck-agent.msi
fleetdeck-agent.mst
Code signing
- signer name
- FLEETDECK INC.
- certificate thumbprint
- CA172BACE97F7C97A6AE9E16CC9360F59E7B9CF4
- tbs sha256
- 10BA0C15DBB8A3DCC97DA22C8EE7ABA6577CD4733356520890518CE115736DFE
- tbs sha1
- Not recorded
- signer name
- FleetDeck Inc
- certificate thumbprint
- 77DAF21A6F30487919801D224AADAE95549DBF7B
- tbs sha256
- 67FB7502C5558CAA36C59E6A08ACCB243C2369C7BB3214A9A321F8CEA5DB16E0
- tbs sha1
- Not recorded
- signer name
- FleetDeck Inc
- certificate thumbprint
- FD1A886C50EFD9778C8A046967701E34E7A65C12
- tbs sha256
- 2B558A81F2AE1CFC91FBC2B16A79BBACE77FA34F140C3418D6CF7DC4502AFCBE
- tbs sha1
- Not recorded
search names
company names
signer names
FLEETDECK INC.
FleetDeck Inc
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe
- Description
- FleetDeck agent service executable (verified via official documentation)
- OS
- Windows
- File
- C:\Program Files (x86)\FleetDeck Agent\*\fleetdeck_agent.exe
- Description
- FleetDeck agent executable (verified via official documentation)
- OS
- Windows
- File
- C:\Program Files (x86)\FleetDeck Agent\*\fd_agent.dll
- Description
- FleetDeck agent DLL (reported in GitHub issue)
- OS
- Windows
- File
- C:\Windows\Temp\FleetDeck\*
- Description
- FleetDeck temporary files directory (verified via official documentation)
- OS
- Windows
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 7045
- Description
- Service installation event for FleetDeck Agent Service
- OS
- Windows
FORENSIC EVIDENCE
Registry artifacts
- Path
- HKLM\SYSTEM\CurrentControlSet\Services\FleetDeck Agent Service
- Description
- FleetDeck service registry key
- OS
- Windows
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- *.fleetdeck.io
- fleetdeck.io
- agentmqtt.fleetdeck.io
- checkip.zmazonaws.com
- Ports
- 443
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/fleetdeck_network_sigma.yml
- Description
- Detects potential network activity of FleetDeck.io RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/fleetdeck_processes_sigma.yml
- Description
- Detects potential processes activity of FleetDeck.io RMM tool
References
Acknowledgements
- Person
- default1337
- Handle
- @default1337