RMM

Net Monitor for Employees

Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware.

Tool overview

Category
RMM
Research authors
Daniel Koifman (KoifSec)
Created
2026-02-12
Last modified
2026-02-12
Privileges
User
Free / availability
Yes
Verification required
Yes
Supported platforms
LinuxWindowsmacOS

Capabilities

Remote Desktop AccessScreen ManagementRemote ShellConnection Management

Executables & installation paths

Installation paths

C:\Program Files (x86)\Net Monitor for Employees Pro\*
C:\Program Files\Net Monitor for Employees Pro\*
nmep_agtconfig.exe
nmep_ctrlagent.exe
nmep_ctrlagentsvc.exe
winpty-agent.exe
winpty-agent64.exe

Detections

AQL
https://github.com/Koifman/LOLRMM/tree/main/detections/sigma/netmonitor_process_sigma.yml
Description
Detects process activity of Network Monitor for Employees

References

Acknowledgements

Person
Daniel Koifman
Handle
@KoifSec