title: Remote Access Tool Services Have Been Installed - System
id: 1a31b18a-f00c-4061-9900-f735b96c99fc
related:
- id: c8b00925-926c-47e3-beea-298fd563728e
type: similar
status: test
description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
references:
- https://redcanary.com/blog/misbehaving-rats/
author: Connor Martin, Nasreddine Bencherchali
date: 2022-12-23
modified: 2023-06-22
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.t1543.003
- attack.t1569.002
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: 'Service Control Manager'
EventID:
- 7045
- 7036
ServiceName|contains:
# Based on https://github.com/SigmaHQ/sigma/pull/2841
- 'AmmyyAdmin' # https://www.ammyy.com/en/
- 'Atera'
- 'BASupportExpressSrvcUpdater' # https://www.systemlookup.com/O23/6837-BASupSrvcUpdater_exe.html
- 'BASupportExpressStandaloneService' # https://www.systemlookup.com/O23/6839-BASupSrvc_exe.html
- 'chromoting'
- 'GoToAssist' # https://www.goto.com/it-management/resolve
- 'GoToMyPC' # https://get.gotomypc.com/
- 'jumpcloud'
- 'LMIGuardianSvc' # https://www.logmein.com/
- 'LogMeIn' # https://www.logmein.com/
- 'monblanking'
- 'Parsec'
- 'RManService' # https://www.systemlookup.com/O23/7855-rutserv_exe.html
- 'RPCPerformanceService' # https://www.remotepc.com/
- 'RPCService' # https://www.remotepc.com/
- 'SplashtopRemoteService' # https://www.splashtop.com/
- 'SSUService'
- 'TeamViewer'
- 'TightVNC' # https://www.tightvnc.com/
- 'vncserver'
- 'Zoho'
condition: selection
falsepositives:
- Unknown
level: medium