Query: detect An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm in logs
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Simple Help Execution id: 95e60a2b-4705-444b-b7da-ba0ea81a3ee2 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-23 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|contains: - \JWrapper-Remote Access\ - \JWrapper-Remote Support\ Image|endswith: \SimpleService.exe condition: selection falsepositives: - Legitimate usage of the tool level: medium
Near-miss passage: Sigma rule: Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for C. Logsource: windows / registry_delete. Rule: title: Removal of Potential COM Hijacking Registry Keys id: 96f697b0-b499-4e5d-9908-a67bec11cdb6 status: test description: 'Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks. ' references: - https://github.com/OTRF/detection-hackathon-apt29/issues/7 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md - https://learn.microsoft.com/en-us/windows/win32/shell/launch - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-10-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_delete detection: selection: TargetObject|endswith: \shell\open\command filter_main_explorer: Image|endswith: C:\Windows\explorer.exe filter_main_svchost: Image: C:\Windows\system32\svchost.exe filter_main_msiexec: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_generic_prorams: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_openwith: Image: C:\Windows\System32\OpenWith.exe filter_optional_dropbox: Image|endswith: \Dropbox.exe TargetObject|contains: \Dropbox. filter_optional_wireshark: Image|endswith: \AppData\Local\Temp\Wireshark_uninstaller.exe TargetObject|contains: \wireshark-capture-file\ filter_optional_peazip: Image|contains: peazip TargetObject|contains: \PeaZip. filter_optional_everything: Image|endswith: \Everything.exe TargetObject|contains: \Everything. filter_optional_uninstallers: Image|startswith: C:\Windows\Installer\MSI filter_optional_java: Image|startswith: C:\Program Files (x86)\Java\ Image|endswith: \installer.exe TargetObject|contains: \Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F} filter_optional_edgeupdate: Image|contains: \Microsoft\EdgeUpdate\Install filter_optional_avira: Image: - C:\Program Files (x86)\Avira\Antivirus\ - C:\Program Files\Avira\Antivirus\ TargetObject|endswith: - \CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command - \AntiVir.Keyfile\shell\open\command filter_optiona