TIFLUX RMM Malspam Campaign Detection Query
Huntress has observed Tiflux being used in attacks that aim to establish persistence, transmit screenshots, and run commands to collect system profiling information. Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
Microsoft Sentinel (KQL)
