RMM

ManageEngine ServiceDesk Plus

ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RMM
Research authors: Michael Haag
Created: 2026-01-15
Last modified: 2026-01-15
Privileges: SYSTEM
Free / availability: Trial Available
Verification required: Code-signed
Supported platforms: LinuxWindows

Capabilities

Remote ControlRemote DesktopIT Service ManagementIncident ManagementAsset ManagementHelp Desk

Executables & installation paths

Filename: ManageEngine_ServiceDesk_Plus.exe
OriginalFileName: InstallShield Setup.exe
Description: ManageEngine ServiceDesk Plus installer (verified via VirusTotal)

Filename: ManageEngine_ServiceDesk_Plus.bin
OriginalFileName: Not recorded
Description: ManageEngine ServiceDesk Plus binary installer component

Installation paths

ManageEngine_ServiceDesk_Plus.exe

ManageEngine_ServiceDesk_Plus.bin

C:\Program Files\ManageEngine\ServiceDesk\*

C:\Program Files (x86)\ManageEngine\ServiceDesk\*

FORENSIC EVIDENCE

Disk artifacts

File: C:\Program Files\ManageEngine\ServiceDesk\*
Description: ManageEngine ServiceDesk Plus installation directory (verified via VirusTotal sandbox)
OS: Windows

File: C:\Users\*\AppData\Local\Temp\{*}\ManageEngine_ServiceDesk_Plus.exe
Description: ManageEngine ServiceDesk Plus temporary installer files (verified via VirusTotal sandbox)
OS: Windows

FORENSIC EVIDENCE

Event log artifacts

EventID: 4688
Description: Process creation event for ManageEngine_ServiceDesk_Plus.exe
OS: Windows

EventID: 7045
Description: Service installation event for ManageEngine ServiceDesk
OS: Windows

FORENSIC EVIDENCE

Registry artifacts

Path: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{*}
Description: ManageEngine ServiceDesk Plus uninstall registry keys (verified via VirusTotal sandbox)
OS: Windows

FORENSIC EVIDENCE

Network artifacts

Description

Known remote domains

Domains

*.manageengine.com
manageengine.com

Ports

443
8080

References

Acknowledgements

Person: fuzzybug
Handle: @fuzzybug