Detection of Xeox RMM

Daniel Koifman@Koifsec

•updated Mar 31, 2026•4•0•109

This rule detects the execution or presence of files related to the Xeox Remote Monitoring and Management (RMM) tool. It specifically looks for process creation events where the image file name, original file name, or parent base file name contains 'xeox_' or 'xeox-', or where the image file path includes '\xeox\'. This helps identify the initial execution or persistence mechanisms of the Xeox RMM.