Remote Management and Monitoring tool - Level - Create Process

id: 42ee6265-ed2d-42b6-9c69-095092dce2e3
name: Remote Management and Monitoring tool - Level - Create Process
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceProcessEvents 
  | where Timestamp between (Time_start..Time_end)
  | where FileName startswith "level"
      and FolderPath has_any (
          @'\Program Files\Level\', 
          @'\Program Files (x86)\Level\'
      )
      and isempty(ProcessVersionInfoCompanyName)
      and isempty(ProcessVersionInfoProductName)
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName