LOLRMM tool executions

Saved search rmm

Process starts whose image matches a LOLRMM install path, with the tool's name.

Part of: Remote management tool hunting
Requires: LOLRMM tools

Add it

In Bifract, open Exchange, find LOLRMM tool executions and click Add. Saves the search for everyone in the fractal.

File

exchange/searches/lolrmm-executions.yaml

lolrmm-executions.yaml

name: LOLRMM tool executions
description: Process starts whose image matches a LOLRMM install path, with the tool's name.
query: |-
  event_id=1
  | match(dict=lolrmm, field=image, column=InstallationPaths, include=[Name], require=true)
  | table(timestamp, computer_name, user, Name, image, commandline)
tags: [rmm]
time_range: 24h