Skip to content
Threat Feed
Subscribe

Product

ImmyBot

2 briefs RSS
low advisory

Detection of RMM Software Deployment via Internet-Originated MSI Files

This detection identifies the download and execution of Windows Installer (MSI) packages from the internet that result in the installation of remote monitoring and management (RMM) software used for persistent system access.

Acronis Cyber Protect Connect +43 defense-evasion command-and-control windows rmm
1t
medium advisory

Suspicious DNS Queries to Remote Monitoring and Management Domains from Non-Browser Processes

This brief details the detection of DNS queries targeting commonly abused Remote Monitoring and Management (RMM) or remote access software domains, originating from non-browser processes, which is a common tactic for command and control, persistence, and lateral movement by threat actors.

01com +151 windows command-and-control endpoint rmm remote-access
1r 193i