Detectionmediumtest

PUA - Radmin Viewer Utility Execution

Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Sat Jan 22Updated Mon Dec 115817e76f-4804-41e6-8f1d-5fa0b3ecae2dwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        - Description: 'Radmin Viewer'
        - Product: 'Radmin Viewer'
        - OriginalFileName: 'Radmin.exe'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0002 · Execution TA0008 · Lateral Movement

Techniques

T1072 · Software Deployment Tools

Rule Metadata

Rule ID

5817e76f-4804-41e6-8f1d-5fa0b3ecae2d

Status

test

Level

medium

Type

Detection

Created

Sat Jan 22

Modified

Mon Dec 11

Author

François Hubaut

Path

rules/windows/process_creation/proc_creation_win_pua_radmin.yml

Raw Tags

attack.executionattack.lateral-movementattack.t1072

View on GitHub