Remote Access Tool Service Installation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•6•0•50

Detects the installation of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools for persistence, privilege escalation, and remote control of compromised systems.