BITSAdmin/Certutil ConnectWise Installation

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•3

Detects the use of bitsadmin.exe or certutil.exe to download and install legitimate Remote Monitoring and Management (RMM) tools like ConnectWise Control. This activity is often associated with adversaries establishing persistent graphical access after initial compromise, as observed in campaigns like Storm-1175.