RMM
LabTech RMM (Now ConnectWise Automate)
LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Not recorded
- Created
- 2024-08-02
- Last modified
- 2024-08-02
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
ltsvc.exe
ltsvcmon.exe
lttray.exe
Code signing
- signer name
- ConnectWise, LLC
- certificate thumbprint
- DC69069188D5CBC5FE18B7D035C90061C8741E21
- src file sha256
- 66b1ef65896e9f91efd1e3347e70eb2cf1708e1ce2ca267fb4704858aa3ee028
- src file path
- downloaded_files/labtech_rmm_(now_connectwise_automate)/66b1ef65896e9f91efd1e3347e70eb2cf1708e1ce2ca267fb4704858aa3ee028
- src file company
- LabTech Software
- signer name
- ConnectWise, LLC
- certificate thumbprint
- 70644D15A9833AE7E85FCC0D2146831978BEEFF4
- src file sha256
- 532d20a37c6493fae3144fa8aae0a2c3510f6bdc0a2683e9ce7970d6a22d65c2
- src file path
- downloaded_files/labtech_rmm_(now_connectwise_automate)/532d20a37c6493fae3144fa8aae0a2c3510f6bdc0a2683e9ce7970d6a22d65c2
- src file company
- LabTech Software
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- connectwise.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/labtech_rmm__now_connectwise_automate__network_sigma.yml
- Description
- Detects potential network activity of LabTech RMM (Now ConnectWise Automate) RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/labtech_rmm__now_connectwise_automate__processes_sigma.yml
- Description
- Detects potential processes activity of LabTech RMM (Now ConnectWise Automate) RMM tool