• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Remote Management and Monitoring tool - DistantDesktop - Network Connection

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•27

    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/RemoteManagementMonitoringTools

    Microsoft Sentinel (KQL)

    Tags

    T1219 - Remote Access ToolsTA0011 - Command and ControlT1070.009 - Clear PersistenceT1219.002 - Remote Desktop SoftwareTA0003 - PersistenceTA0005 - Defense EvasionT1021.006 - Windows Remote ManagementT1028 - Windows Remote ManagementT1047 - Windows Management InstrumentationT1041 - Exfiltration Over C2 ChannelT1048.003 - Exfiltration Over Unencrypted Non-C2 ProtocolT1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1094 - Custom Command and Control ProtocolDS0017 - CommandT1219.003 - Remote Access HardwareT1592.002 - SoftwareT1021 - Remote ServicesTA0008 - Lateral MovementTA0002 - ExecutionTA0010 - ExfiltrationTA0043 - ReconnaissanceNetwork Connection OutboundWindowsWindows Defender Atpkql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?