Vendor
medium
advisory
First Time Seen Remote Monitoring and Management Tool Execution
3 rulesDetects the execution of previously unseen remote monitoring and management (RMM) tools or remote access software on compromised Windows endpoints, often leveraged for command-and-control, persistence, and execution of malicious commands.
Elastic Defend +101
remote-access
rmm
command-and-control
persistence
3r
medium
advisory
Remote Execution via File Shares
2 rules 2 TTPsThis rule identifies the execution of a file that was created by the virtual system process, potentially indicating lateral movement via network file shares in Windows environments.
lateral-movement
file-share
windows
2r
2t
medium
advisory
Remote Execution via File Shares
2 rules 2 TTPsThe rule identifies the execution of a file created by the virtual system process, potentially indicating lateral movement via network file shares, by detecting a sequence of file creation/modification followed by process execution, excluding trusted vendors.
Elastic Defend
lateral-movement
file-shares
windows
2r
2t