Detectionmediumtest
TacticalRMM Service Installation
Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Mon Nov 284bb79b62-ef12-4861-981d-2aab43fab642windows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic2 selectors
detection:
selection_root:
Provider_Name: 'Service Control Manager'
EventID: 7045
selection_service:
- ImagePath|contains: 'tacticalrmm.exe'
- ServiceName|contains: 'TacticalRMM Agent Service'
condition: all of selection_*False Positives
Legitimate use of the tool
References
MITRE ATT&CK
Tactics
Other
attack.t1219.002
Rule Metadata
Rule ID
4bb79b62-ef12-4861-981d-2aab43fab642
Status
test
Level
medium
Type
Detection
Created
Mon Nov 28
Path
rules/windows/builtin/system/service_control_manager/win_system_service_install_tacticalrmm.yml
Raw Tags
attack.command-and-controlattack.t1219.002