SignalHunt
← All rules

SYS-4007

high

Remote Monitoring & Management Tool Executed

Detects execution of a legitimate remote access / RMM tool (AnyDesk, TeamViewer, ScreenConnect, Atera). These are signed, legitimate products, so they sail past application allow-listing and AV - which is exactly why intrusions install them as a resilient backup channel alongside their real C2. The finding is not that the tool is malicious; it is that it appeared on a host where your organisation never deployed it.

T1219
Test this rule in the simulator

Detection logic

Fires as soon as one event matches: `EventID` is 1 AND `Image` ends with "AnyDesk.exe" or "TeamViewer.exe" or "ScreenConnect.ClientService.exe" or "AteraAgent.exe".

{
  "detection_type": "selection",
  "selection": {
    "EventID": 1,
    "Image|endswith": [
      "AnyDesk.exe",
      "TeamViewer.exe",
      "ScreenConnect.ClientService.exe",
      "AteraAgent.exe"
    ]
  }
}

Log source: product=windows, service=sysmon · Event ID(s): 1

Required log fields

  • Image
  • ParentImage
  • CommandLine
  • User
  • Hashes

Enabling this in your environment

Where: Sysmon configuration - ProcessCreate (Event ID 1) enabled, which baseline configs include by default.

sysmon64.exe -c sysmonconfig.xml

Pair with WIN-1006 (7045): these tools install a service as well as running a process, so the two rules corroborate each other. If your organisation standardises on one RMM product, invert this rule - alert on every product except that one.

Seen in incidents

False positives

  • Sanctioned remote support tooling - this rule is only meaningful with an allow-list of the products and hosts IT actually uses

References