RMM
NetLock RMM
NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering.
Tool overview
- Category
- RMM
- Research authors
- Tyler Schultz
- Created
- 2025-07-18
- Last modified
- 2025-07-18
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
Linux
Windows
macOS
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
NetLock_RMM_Agent_Installer.exe
NetLock_RMM_Agent_Installer
/var/0x101_Cyber_Security/*
/Library/Application Support/0x101_Cyber_Security/*
/usr/local/bin/0x101_Cyber_Security/Netlock_RMM/*
/usr/0x101_Cyber_Security/Netlock_RMM/*
C:\ProgramData\0x101 Cyber Security\NetLock RMM\Comm Agent\*
C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_Process.exe
C:\Program Files\0x101 Cyber Security\NetLock RMM\UserAgent\NetLock_RMM_User_UAC.exe
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\temp\netlock rmm\installer\logs\*
- Description
- Debug and error logs related to installation
- OS
- Windows
- File
- C:\ProgramData\0x101 Cyber Security\NetLock RMM\Comm Agent\server_config.json
- Description
- Server Configuration File
- OS
- Windows
- File
- /etc/systemd/system/netlock-rmm-agent-comm.service
- Description
- Netlock RMM Agent comm agent service
- OS
- Linux
- File
- /Library/LaunchDaemons/com.netlock.rmm.agentcomm.plist
- Description
- macOS LaunchDaemon plist File
- OS
- macOS
- File
- /var/log/netlock-rmm-agent-comm.log
- Description
- RMM agent comm log (Non-Windows)
- OS
- Linux
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/netlock_rmm_files_sigma.yml
- Description
- Detects potential files activity of NetLock RMM RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/netlock_rmm_processes_sigma.yml
- Description
- Detects potential processes activity of NetLock RMM RMM tool
References
Acknowledgements
- Person
- Tyler Schultz
- Handle
- @shockwave_ts