Query: alert when An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - GoToAssist Execution id: b6d98a4f-cef0-4abf-bbf6-24132854a83d status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows author: frack113 date: 2022-02-13 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: GoTo Opener - Product: GoTo Opener - Company: LogMeIn, Inc. condition: selection falsepositives: - Legitimate use level: medium
Near-miss passage: Sigma rule: Detects driver load of the System Informer tool. Logsource: windows / driver_load. Rule: title: PUA - System Informer Driver Load id: 10cb6535-b31d-4512-9962-513dcbc42cc1 related: - id: 67add051-9ee7-4ad3-93ba-42935615ae8d type: similar status: test description: Detects driver load of the System Informer tool references: - https://systeminformer.sourceforge.io/ - https://github.com/winsiderss/systeminformer author: Florian Roth (Nextron Systems) date: 2023-05-08 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|endswith: \SystemInformer.sys - Hashes|contains: - SHA256=8B9AD98944AC9886EA4CB07700E71B78BE4A2740934BB7E46CA3B56A7C59AD24 - SHA256=A41348BEC147CA4D9EA2869817527EB5CEA2E20202AF599D2B30625433BCF454 - SHA256=38EE0A88AF8535A11EFE8D8DA9C6812AA07067B75A64D99705A742589BDD846D - SHA256=A773891ACF203A7EB0C0D30942FB1347648F1CD918AE2BFD9A4857B4DCF5081B - SHA256=4C3B81AC88A987BBDF7D41FA0AECC2CEDF5B9BD2F45E7A21F376D05345FC211D - SHA256=3241BC14BEC51CE6A691B9A3562E5C1D52E9D057D27A3D67FD0B245C350B6D34 - SHA256=047C42E9BBA28366868847C7DAFC1E043FB038C796422D37220493517D68EE89 - SHA256=18931DC81E95D0020466FA091E16869DBE824E543A4C2C8FE644FA71A0F44FEB - SHA256=B4C2EF76C204273132FDE38F0DED641C2C5EE767652E64E4C4071A4A973B6C1B - SHA256=640954AFC268565F7DAA6E6F81A8EE05311E33E34332B501A3C3FE5B22ADEA97 - SHA256=251BE949F662C838718F8AA0A5F8211FB90346D02BD63FF91E6B224E0E01B656 - SHA256=E2606F272F7BA054DF16BE464FDA57211EF0D14A0D959F9C8DCB0575DF1186E4 - SHA256=3A9E1D17BEEB514F1B9B3BACAEE7420285DE5CBDCE89C5319A992C6CBD1DE138 condition: selection falsepositives: - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly level: medium