RMM
Net Monitor for Employees
Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware.
Tool overview
- Category
- RMM
- Research authors
- Daniel Koifman (KoifSec)
- Created
- 2026-02-12
- Last modified
- 2026-02-12
- Privileges
- User
- Free / availability
- Yes
- Verification required
- Yes
- Supported platforms
Linux
Windows
macOS
Capabilities
Executables & installation paths
Installation paths
C:\Program Files (x86)\Net Monitor for Employees Pro\*
C:\Program Files\Net Monitor for Employees Pro\*
nmep_agtconfig.exe
nmep_ctrlagent.exe
nmep_ctrlagentsvc.exe
winpty-agent.exe
winpty-agent64.exe
Detections
- AQL
- https://github.com/Koifman/LOLRMM/tree/main/detections/sigma/netmonitor_process_sigma.yml
- Description
- Detects process activity of Network Monitor for Employees
References
Acknowledgements
- Person
- Daniel Koifman
- Handle
- @KoifSec