Remote Access Tool Services Have Been Installed - System

Title: Remote Access Tool Services Have Been Installed - System
Status: test
Description:Detects service installation of different remote access tools software. These software are often abused by threat actors to perform
References:
  -https://redcanary.com/blog/misbehaving-rats/
Author: Connor Martin, Nasreddine Bencherchali
Date: 2022-12-23
modified:2023-06-22
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.t1543.003'
• -'attack.t1569.002'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID:
      -'7045'
      -'7036'

    ServiceName|contains:
      -'AmmyyAdmin'
      -'Atera'
      -'BASupportExpressSrvcUpdater'
      -'BASupportExpressStandaloneService'
      -'chromoting'
      -'GoToAssist'
      -'GoToMyPC'
      -'jumpcloud'
      -'LMIGuardianSvc'
      -'LogMeIn'
      -'monblanking'
      -'Parsec'
      -'RManService'
      -'RPCPerformanceService'
      -'RPCService'
      -'SplashtopRemoteService'
      -'SSUService'
      -'TeamViewer'
      -'TightVNC'
      -'vncserver'
      -'Zoho'

  condition:selection
Falsepositives:
  -Unknown
Level: medium