LOLRMM tools¶
Lookup rmm windows
Remote monitoring and management tools attackers abuse, keyed on their install paths as globs. Use with match() on a process image to flag RMM tools.
From: Magic Sword
Part of: Remote management tool hunting
Required by: RMM tools by user, LOLRMM tool executions, Remote Management Tools
Add it¶
In Bifract, open Exchange, find LOLRMM tools and click Add. Adds a lookup filled from the URL below, refreshed on its schedule. Needs a tenant admin.
Settings¶
| Setting | Value |
|---|---|
| Lookup name | lolrmm |
| Kind | pattern |
| URL | https://raw.githubusercontent.com/magicsword-io/LOLRMM/main/website/public/api/rmm_tools.csv |
| Key column | InstallationPaths |
| Other columns | Name, Description |
| Split key cells on | , |
| Keys are globs | yes |
| Refresh every | 1 day |