Suspicious Itarian Agent RMM Child Process

Tim Peck@timpeck

•updated Sep 12, 2025•0•41

Detects the ITarian RMM service (RmmService.exe) spawning a child process from various suspicious directories commonly used for malware staging. This behavior is associated with adversaries using ITarian for post-exploitation activities, such as dropping additional malware.