Remote management tool hunting

Bundle rmm windows

Find remote monitoring and management tools from Magic Sword's LOLRMM list: the lookup, a per-user rarity model, an alert for tools rare for their user, a saved search and a dashboard.

From: Magic Sword

Add it

In Bifract, open Exchange, find Remote management tool hunting and click Add. Adds each of its items that is not there yet, requirements first.

Contents

Kind	Item	What it is
Lookup	LOLRMM tools	Remote monitoring and management tools attackers abuse, keyed on their install paths as globs. Use with match() on a process image to flag RMM tools.
Model	RMM tools by user	Rarity model of which LOLRMM tools each user runs, so a tool new to a user stands out. Needs Sysmon process events with a user field.
Detection	Remote Management Tool Rare for the User	A user ran a LOLRMM tool that is new to them or a small share of their RMM use.
Saved search	LOLRMM tool executions	Process starts whose image matches a LOLRMM install path, with the tool's name.
Dashboard	Remote Management Tools	Which RMM tools run, where, by whom, and which are rare for their user.