Product
low
advisory
Detection of RMM Software Deployment via Internet-Originated MSI Files
1 TTPThis detection identifies the download and execution of Windows Installer (MSI) packages from the internet that result in the installation of remote monitoring and management (RMM) software used for persistent system access.
Acronis Cyber Protect Connect +43
defense-evasion
command-and-control
windows
rmm
1t
high
advisory
Spring Ring Voice Phishing Campaign Targeting Microsoft Teams
2 TTPs 8 IOCsThe Spring Ring campaign is a coordinated voice phishing operation impersonating IT help desk staff via Microsoft Teams to coerce victims into executing remote access tools or facilitating NTLM relay attacks against domain controllers.
Microsoft Teams +1
phishing
social-engineering
identity
teams
vishing
2t
8i
medium
advisory
First Time Seen Remote Monitoring and Management Tool Detection
1 rule 3 TTPs 5 IOCsAdversaries are leveraging legitimate Remote Monitoring and Management (RMM) and remote access tools on Windows endpoints for command-and-control, persistence, and execution, with detection focusing on the first observed instance of these tools on a host.
AA +132
command-and-control
persistence
execution
rmm
remote-access
windows
1r
3t
5i