RMM

Kaseya (VSA)

Kaseya (VSA) aka Unigma is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RMM
Research authors: Nasreddine Bencherchali
Created: 2024-08-05
Last modified: 2024-08-05
Privileges: Not recorded
Free / availability: Not recorded
Verification required: Not recorded
Supported platforms: Windows

Executables & installation paths

Filename: agentmon.exe

Filename: KaUpdHlp.exe

Filename: KaUsrTsk.exe
OriginalFileName: Not recorded
Description: Not recorded

Installation paths

C:\Program Files (x86)\Kaseya\

C:\ProgramData\Kaseya\

FORENSIC EVIDENCE

Disk artifacts

File: %localappdata%\Kaseya\Log\KaseyaLiveConnect\*
Description: Kaseya Live Connect logs
OS: Windows

File: ~/Library/Logs/com.kaseya/KaseyaLiveConnect/*
Description: Kaseya Live Connect logs
OS: MacOS

File: C:\ProgramData\Kaseya\Log\Endpoint\*
Description: Kaseya Endpoint logs
OS: Windows

File: C:\Program Files*\Kaseya\*\agentmon.log
Description: Kaseya Agent Monitor log
OS: Windows

File: /var/log/system.log
Description: Kaseya Agent Monitor log
OS: MacOS 32bit

File: ~/opt/kaseya/*/logs*
Description: Kaseya Agent Monitor log
OS: MacOS 64bit

File: C:\Users\*\AppData\Local\Temp\KASetup.log
Description: Kaseya Setup log in user temp directory
OS: Windows

File: C:\Windows\Temp\KASetup.log
Description: Kaseya Setup log in Windows temp directory
OS: Windows

File: C:\ProgramData\Kaseya\Log\KaseyaEdgeServices\*
Description: Kaseya Edge Services logs
OS: Windows

File: C:\Kaseya\api\v1.0\logs\
Description: Kaseya API logs
OS: Windows

File: C:\Kaseya\api\v1.5\endpoint\logs
Description: Kaseya API logs
OS: Windows

File: C:\Kaseya\api\v1.5\endpoints\logs
Description: Kaseya API logs
OS: Windows

File: C:\Windows\System32\config\systemprofile\AppData\Local\Kaseya\Log\MakeSelfSignedCert.exe\
Description: Certificate creation
OS: Windows

File: C:\Kaseya\WebPages\install\makecert.txt
Description: Certificate creation
OS: Windows

File: C:\ProgramData\Kaseya\Log\Endpoint\Instance_*\KaseyaEndpoint*
Description: Endpoint service logs
OS: Windows

File: C:\ProgramData\Kaseya\Log\Endpoint\Instance_*\Session_*
Description: Session logs
OS: Windows

FORENSIC EVIDENCE

Network artifacts

Description

Known remote domains

Domains

deploy01.kaseya.com
managedsupport.kaseya.net
*.managedsupport.kaseya.net
*.kaseya.net
kaseya.com

Ports

Not recorded

Detections

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/kaseya__vsa__network_sigma.yml
Description: Detects potential network activity of Kaseya (VSA) RMM tool

Sigma: https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/kaseya__vsa__files_sigma.yml
Description: Detects potential files activity of Kaseya (VSA) RMM tool