Skip to content
Threat Feed
Subscribe

Vendor

Remote Utilities LLC

2 briefs RSS
medium advisory

First Time Seen Remote Monitoring and Management Tool Execution

Detects the execution of previously unseen remote monitoring and management (RMM) tools or remote access software on compromised Windows endpoints, often leveraged for command-and-control, persistence, and execution of malicious commands.

Elastic Defend +101 remote-access rmm command-and-control persistence
3r
medium advisory

First Time Seen Remote Monitoring and Management Tool Usage

This rule detects the first time a remote monitoring and management (RMM) or remote access process is seen on a host within a defined history window, indicating potential command-and-control, persistence, or unauthorized remote access activity.

ScreenConnect Client +40 rmm remote_access command_and_control
3r