Analytics Story: Remote Monitoring and Management Software

Updated Date: 2026-05-13 ID: e405907a-273c-41c9-928c-768c9355c1f7 Author: Steven Dick Product: Splunk Enterprise Security

Description

Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM).

Why it matters

Attackers can leverage a variety of 3rd party software to establish unapproved remote access or c2 channels to an enterprise network. Common techniques include the installation of these remote access software via channels via phishing, scam, or driveby malware compromise situations. While this Analytic Story is not a comprehensive listing of all RMM software it provides a useful starting point for well known indicators.

Be sure to leverage the "RMM Software Tracking" dashboard provided with this story for a convienent way to vizualize RMM usage in your enviroment.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Level RMM Watchdog Task Created	Scheduled Task/Job, Remote Access Tools	Anomaly
Detect Remote Access Software Usage File	Remote Access Tools	Anomaly
Windows Suspicious C2 Named Pipe	SMB/Windows Admin Shares, Process Injection, Inter-Process Communication	TTP
Detect Remote Access Software Usage URL	Remote Access Tools	Anomaly
HTTP RMM User Agent	Web Protocols, Remote Access Tools	Anomaly
Detect Remote Access Software Usage Registry	Remote Access Tools	Anomaly
Windows RMM Tool Execution	Remote Access Tools	Anomaly
Cisco Secure Firewall - Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
Detect Remote Access Software Usage DNS	Remote Access Tools	Anomaly
Detect Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
Detect Remote Access Software Usage FileInfo	Remote Access Tools	Anomaly
Windows Level RMM PowerShell Script Installer	Remote Access Tools	Anomaly
Windows RMM Named Pipe	SMB/Windows Admin Shares, Process Injection, Inter-Process Communication	Anomaly
Detect Remote Access Software Usage Process	Remote Access Tools	Anomaly
Windows Suspicious Named Pipe	SMB/Windows Admin Shares, Process Injection, Inter-Process Communication	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Windows Event Log Security 4698	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Palo Alto Network Threat	Network	`pan:threat`	`not_applicable`
Suricata	Other	`suricata`	`not_applicable`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Cisco Secure Firewall Threat Defense Connection Event	Other	`cisco:sfw:estreamer`	`not_applicable`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Palo Alto Network Traffic	Network	`pan:traffic`	`not_applicable`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`

References

Source: GitHub | Version: 2