Renamed RMM Tools

title: RMM Tool Downloaded via Browser and Executed
id: c9d3e5f7-a9b1-4c3d-5e6f-7a8b9c0d1e2f
status: experimental
description: >
  Detects RMM tool executables created by a browser in download locations. Distinguishes
  user-initiated downloads from IT-deployed RMM installations.
references:
  - https://attack.mitre.org/techniques/T1219/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.command_and_control
  - attack.t1219
  - detection.maturity.hunt
logsource:
  category: file_event
  product: windows
detection:
  selection_download_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Temp\'
      - '\AppData\Roaming\Temp\'
  selection_browser_creator:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\opera.exe'
      - '\brave.exe'
      - '\vivaldi.exe'
  selection_executable:
    TargetFilename|endswith:
      - '.exe'
      - '.msi'
  filter_legit_software:
    # Tune for your environment — add legitimate software that triggers this rule
    TargetFilename|endswith:
      - '\placeholder_tune_for_your_env.exe'
  condition: selection_download_path and selection_browser_creator and selection_executable and not filter_legit_software
falsepositives:
  - Legitimate software downloads by users (any browser-downloaded executable)
  - IT staff downloading RMM tools for authorized deployment
level: low

title: Masqueraded RMM Tool with Campaign-Themed Filename Downloaded via Browser
id: d0e4f6a8-b0c2-4d4e-6f7a-8b9c0d1e2f3a
status: experimental
description: >
  Detects browser-downloaded executables with campaign-themed names whose PE metadata
  (OriginalFilename or signer) matches a known RMM vendor.
references:
  - https://attack.mitre.org/techniques/T1219/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.command_and_control
  - attack.t1219
  - detection.maturity.analyst
logsource:
  category: process_creation
  product: windows
detection:
  # Executable downloaded from browser to user-writable location
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Temp\'
      - '\Desktop\'
  # Campaign-themed filename patterns (tax season, invoice, IT support pretexts)
  selection_campaign_name:
    Image|contains:
      - 'tax'
      - 'invoice'
      - 'Invoice'
      - 'Tax'
      - 'SSN'
      - 'SSA'
      - 'W-2'
      - 'W2'
      - '1099'
      - 'refund'
      - 'Refund'
      - 'support'
      - 'Support'
      - 'verify'
      - 'Verify'
      - 'secure'
      - 'Secure'
      - 'helpdesk'
      - 'HelpDesk'
      - 'IT_'
      - 'remote_'
  # Original filename or description matches known RMM vendors
  # (requires file metadata enrichment — Sysmon FileVersion fields or EDR metadata)
  selection_rmm_metadata:
    OriginalFileName|contains:
      - 'AnyDesk'
      - 'anydesk'
      - 'ScreenConnect'
      - 'screenconnect'
      - 'TeamViewer'
      - 'teamviewer'
      - 'UltraViewer'
      - 'ultraviewer'
      - 'RustDesk'
      - 'rustdesk'
      - 'MeshAgent'
      - 'meshagent'
  filter_legit_software:
    # Tune for your environment — add legitimate software that triggers this rule
    Image|endswith:
      - '\placeholder_tune_for_your_env.exe'
  condition: selection_path and selection_campaign_name and selection_rmm_metadata and not filter_legit_software
falsepositives:
  - Legitimate tax or invoice software that happens to have RMM integration
  - IT staff downloading RMM tools with descriptive names for asset tracking
level: high

title: Masqueraded RMM Tool with Campaign-Themed Filename Downloaded via Browser
id: d0e4f6a8-b0c2-4d4e-6f7a-8b9c0d1e2f3a
status: experimental
description: >
  Detects browser-downloaded executables with campaign-themed names whose PE metadata
  (OriginalFilename or signer) matches a known RMM vendor.
references:
  - https://attack.mitre.org/techniques/T1219/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.command_and_control
  - attack.t1219
  - detection.maturity.analyst
logsource:
  category: process_creation
  product: windows
detection:
  # Executable downloaded from browser to user-writable location
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Temp\'
      - '\Desktop\'
  # Campaign-themed filename patterns (tax season, invoice, IT support pretexts)
  selection_campaign_name:
    Image|contains:
      - 'tax'
      - 'invoice'
      - 'Invoice'
      - 'Tax'
      - 'SSN'
      - 'SSA'
      - 'W-2'
      - 'W2'
      - '1099'
      - 'refund'
      - 'Refund'
      - 'support'
      - 'Support'
      - 'verify'
      - 'Verify'
      - 'secure'
      - 'Secure'
      - 'helpdesk'
      - 'HelpDesk'
      - 'IT_'
      - 'remote_'
  # Original filename or description matches known RMM vendors
  # (requires file metadata enrichment — Sysmon FileVersion fields or EDR metadata)
  selection_rmm_metadata:
    OriginalFileName|contains:
      - 'AnyDesk'
      - 'anydesk'
      - 'ScreenConnect'
      - 'screenconnect'
      - 'TeamViewer'
      - 'teamviewer'
      - 'UltraViewer'
      - 'ultraviewer'
      - 'RustDesk'
      - 'rustdesk'
      - 'MeshAgent'
      - 'meshagent'
  filter_legit_software:
    # Tune for your environment — add legitimate software that triggers this rule
    Image|endswith:
      - '\placeholder_tune_for_your_env.exe'
  condition: selection_path and selection_campaign_name and selection_rmm_metadata and not filter_legit_software
falsepositives:
  - Legitimate tax or invoice software that happens to have RMM integration
  - IT staff downloading RMM tools with descriptive names for asset tracking
level: high

title: Known RMM Tool Process Execution
id: b8c2d4e6-f8a0-4b2c-9d3e-5f7a9b1c3d5e
status: experimental
description: >
  Detects execution of known RMM tool processes. Baseline rule for mapping approved
  vs. unapproved RMM usage across the environment.
references:
  - https://attack.mitre.org/techniques/T1219/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.command_and_control
  - attack.t1219
  - detection.maturity.research
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\anydesk.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\teamviewer.exe'
      - '\ultraviewer.exe'
      - '\UltraViewer.exe'
      - '\rustdesk.exe'
      - '\RustDesk.exe'
      - '\meshagent.exe'
      - '\MeshAgent.exe'
    Image|contains:
      - '\ScreenConnect.'
      - '\connectwisecontrol'
      - '\ConnectWiseControl'
  filter_legit_software:
    # Tune for your environment — add legitimate software that triggers this rule
    Image|endswith:
      - '\placeholder_tune_for_your_env.exe'
  condition: selection and not filter_legit_software
falsepositives:
  - Legitimate IT helpdesk use of RMM tools
  - Authorized remote support sessions
  - Security testing environments
level: informational