Known RAT/RMM process patterns

Detect Known RAT RMM Process Patterns

Query

// Author: Alex Teixeira ([email protected])
DeviceProcessEvents
| where Timestamp > ago(60d)
// Speed up the query by filtering most frequent processes
| where FolderPath matches regex @'(?i)^[a-z]:\\\S+\.exe' and not ((FolderPath contains "c:\\windows" and FolderPath matches regex @'(?i)microsoft\.net|softwaredistribution|system32|syswow64|ccm|servicing|winsxs') or FolderPath matches regex @'(?i)^(d:\\apps|c:\\_datas\\)')
// Normalize to frequent (known) RATs
| extend RAT=case(
  FolderPath contains "teamviewer", "TeamViewer",
  FolderPath contains "anydesk", "AnyDesk",
  FolderPath contains "rustdesk", "RustDesk",
  FolderPath contains "vnc", "VNC",
  FolderPath contains "manageengine", "ManageEngine",
  FolderPath contains "fastclient", "FastClient",
  FolderPath contains "logmein", "LogMeIn",
  FolderPath contains "bomgar", "Bomgar",
  FolderPath contains "netviewer", "NetViewer",
  FolderPath contains "ultraviewer", "UltraViewer",
  FolderPath contains "dwrcs", "Dameware",
  FolderPath contains "splashtop", "Splashtop",
  FolderPath contains "zerotier", "ZeroTier",
  FolderPath contains "supremo", "Supremo",
  "Other"
)
| summarize count(), count_distinct(DeviceName), make_set(DeviceName), max(Timestamp) by RAT, FolderPath
| extend r_1=@'(?i)[\\]+(NetWire|rport)[\\]+|Rsocx|BeAnywhere|DWservice|Fleetdeck|Itarian Endpoint Manager|Splashtop|Level\.io|ManageEngine|ScreenConnect|TrendMicro BaseCamp|Sorillus|ZeroTier|JollyFastVNC|AB Tutor|Barracuda Workplace|SolarWinds RMM|Naverisk'
| extend r_2=@'(?i)(NetSupport|TeamViewer|Anydesk|UltraViewer|realvnc|TightVNC|LogMeIn|fastclient|ultraVNC|bomgar.+scc|accessserver|aeroadmin|alitask|alpemix|ammyy|ateraagent|basupsrvc|basupsrvcupdate|basuptshelper|beamyourscreen|beanywhere|cagservice|chrome remote desktop|clientmrinit|connectwise|connectwisecontrol|crossloopservice|ctiserv|dameware|datto|domotz|dwrcs|dwservice|eratool|ericomconnnectconfigurationtool|ezhelpclient|fixmeit|fixmeitclient|fleetdeck|goverrmc|guacd|instanthousecall|intelliadmin|iperiusremote|islalwaysonmonitor|isllightservice|itarian|jumpclient|jumpdesktop|jumpservice|kaseya|landeskagentbootstrap|laplink|laplinkeverywhere|ldsensors|llrcservice|lmiignition|ltsvcmon|mgntsvc|mikogo|mionet|myivomanager|nateon|neturo|netviewer|nhostsvc|ntrntservice|orcus|pcaquickconnect|pcstarter|pcvisit|pocketcontroller|ptdskclient|pulseway|rcengmgru|rcmgrsvc|rdpwrap|remobo|remote utilities|remoteconsole|remotepass|remotepc|remotepcservice|remotesupportplayeru|remoteview|rfusclient|romfusclient|romserver|romviewer|rpaccess|rpcgrab|rpcsetup|rpcsuite|rpwhostscr|rustdesk|rutserv|rutview|rxstartsupport|screenconnect|seetrolclient|seetrolremote|serverproxyservice|showmypc|simplehelpcustomer|simpleservice|sorillus|sragent|supremo|supremohelper|syncro|tacticalrmm|take\s*control|tdp2tcp|tigervnc|trend.+basecamp|turbomeeting|ultraviewer|vncconnect|webex remote|webrdp|weezo|weezohttpd|windows admin centre|wmcsvc|zerotier|zoho assist).*\.exe$'
| extend r_3=@'(?i)\\(baseclient|BASupApp|DWAgent|ITSMAgent|level|Atera|radmin|srserver|rvagent|intouch)\.exe$'
| where (FolderPath matches regex r_1 or FolderPath matches regex r_2 or FolderPath matches regex r_3)
| extend set_DeviceName=iff(count_distinct_DeviceName>5, strcat("Too many (", count_distinct_DeviceName, ")"), set_DeviceName)
| summarize TotalEvents=sum(count_), DeviceCount=count_distinct(set_DeviceName), Devices=make_set(set_DeviceName), Processes=make_set(FolderPath), LastSeen=max(max_Timestamp) by RAT
| sort by DeviceCount desc, TotalEvents desc

About this query

Explanation

This query is designed to identify and summarize the usage of known Remote Access Tools (RATs) and Remote Monitoring and Management (RMM) software on devices within a network. Here's a simple breakdown of what the query does:

Data Source: It analyzes process events from devices over the past 60 days.
Filtering: The query filters out common system processes and focuses on executable files that are not typically found in standard Windows directories.
Identification: It checks the file paths of these executables against a list of known RAT/RMM software names (like TeamViewer, AnyDesk, VNC, etc.) to identify which software is being used.
Normalization: The query categorizes these executables into known RAT/RMM families or labels them as "Other" if they don't match any known patterns.
Summarization: For each identified RAT/RMM family, it summarizes the data by:
- Counting the total number of events.
- Counting the number of unique devices affected.
- Listing the devices and processes involved.
- Recording the last time each RAT/RMM was seen.
Sorting: The results are sorted to highlight the RAT/RMM families affecting the most devices and generating the most events.
Output: The final output is a table that helps security analysts quickly identify which RAT/RMM tools are most prevalent or unexpected in their network, allowing them to focus on potential security threats.

Details

Bert-Jan Pals

Released: October 20, 2024

Tables

DeviceProcessEvents

Keywords

DeviceProcessEventsFolderPathRATDeviceNameTimestampTimeGeneratedTotalEventsDeviceCountDevicesProcessesLastSeen

Operators

DeviceProcessEventswhereagomatches regexcontainsextendcasesummarizecountcount_distinctmake_setmaxiffstrcatsort by

MITRE Techniques

T1219

Actions

GitHub

KQL Search