Suspicious Remote Access Tool Usage
This rule detects the creation of processes associated with various legitimate remote access and remote monitoring/management (RMM) tools. It specifically looks for common executable names and patterns for tools like AnyDesk, TeamViewer, ngrok, Splashtop, ScreenConnect, ConnectWise Control, Pulseway, TacticalRMM, Tailscale, and Level. The rule includes exclusions for specified administrative users and legitimate parent processes to reduce false positives. The primary goal is to identify potentially unauthorized or suspicious usage of these tools, which can be leveraged by adversaries for remote access, command and control, or data exfiltration.
Sigma
