Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
|
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Low |
Description
An uncommon Remote Monitoring and Management (RMM) product was observed.
Attacker's Goals
- Accessing a remote machine with full interactive graphic interface capabilities.
Investigative actions
- Check if the product usage is approved.
- Ask the owners of the machine if they knowingly used this software.
- Investigate why the software was being used.
- Check if it was executed remotely or locally.
Variations
Uncommon renamed remote monitoring and management toolUncommon remote monitoring and management tool (browser origin)
Uncommon remote monitoring and management tool downloaded from an uncommon source and executed