admin/mthcht-ThreatHunting-Keywords
1
0
Fork 0
mirror of https://github.com/mthcht/ThreatHunting-Keywords synced 2026-06-08 16:12:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
mthcht-ThreatHunting-Keywords/RMM_category_detection.csv
T
mthcht 755048bf5e Mars and April 2025 update 
very few additions and some corrections
2025-04-24 05:55:50 +02:00

1.0 MiB
Raw Permalink Blame History

1keywordmetadata_keyword_regexmetadata_keyword_typemetadata_toolmetadata_descriptionmetadata_tool_techniquesmetadata_tool_tacticsmetadata_malwares_namemetadata_groups_namemetadata_categorymetadata_linkmetadata_enable_endpoint_detectionmetadata_enable_proxy_detectionmetadata_tagsmetadata_commentmetadata_severity_scoremetadata_popularity_scoremetadata_github_starsmetadata_github_forksmetadata_github_updated_atmetadata_github_created_atmetadata_entry_id
2* ./level-darwin-bundle-amd64.pkg*.{0,1000}\s\.\/level\-darwin\-bundle\-amd64\.pkg.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A23
3* ./level-linux-amd64 *.{0,1000}\s\.\/level\-linux\-amd64\s.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A24
4* ./level-linux-arm64 *.{0,1000}\s\.\/level\-linux\-arm64\s.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A25
5* /EV"NetSupport School"*.{0,1000}\s\/EV\"NetSupport\sSchool\".{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A66
6* /f /im RemotePCS*.{0,1000}\s\/f\s\/im\sRemotePCS.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A67
7* /F /TN "Level\Level Watchdog"*.{0,1000}\s\/F\s\/TN\s\"Level\\Level\sWatchdog\".{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A68
8* /monitor /from_service /cpu_memory_refresh * /disk_space_refresh * /proc_list_refresh * /semkey *.{0,1000}\s\/monitor\s\/from_service\s\/cpu_memory_refresh\s.{0,1000}\s\/disk_space_refresh\s.{0,1000}\s\/proc_list_refresh\s.{0,1000}\s\/semkey\s.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A81
9* /r /proxy /proxyport /proxyusername /proxypasswd *.{0,1000}\s\/r\s\/proxy\s\s\/proxyport\s\s\/proxyusername\s\s\/proxypasswd\s.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10#linuxN/A1010N/AN/AN/AN/A93
10* /register /proxy /proxyport /proxyusername /proxypasswd*.{0,1000}\s\/register\s\s\/proxy\s\s\/proxyport\s\s\/proxyusername\s\s\/proxypasswd.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10#linuxN/A1010N/AN/AN/AN/A95
11* <Data>Received Request Run command *</Data>*.{0,1000}\s\<Data\>Received\sRequest\sRun\scommand\s.{0,1000}\<\/Data\>.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A138
12* -a tcrmtshellagentmodule_*.{0,1000}\s\-a\stcrmtshellagentmodule_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A174
13* aeroadmin.exe*.{0,1000}\saeroadmin\.exe.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A241
14* -altgw *.zohoassist.com *.{0,1000}\s\-altgw\s.{0,1000}\.zohoassist\.com\s.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A260
15* chrome-remote-desktop@*.{0,1000}\schrome\-remote\-desktop\@.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A578
16* CN=Quasar Server CA*.{0,1000}\sCN\=Quasar\sServer\sCA.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10#contentN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z621
17* Connection #*. Connection to "*" established. Mode: <Remote control>.*.{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\".{0,1000}\"\sestablished\.\sMode\:\s\<Remote\scontrol\>\..{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#contentN/A1010N/AN/AN/AN/A686
18* Connection #*. Connection to "*". Security check - OK. Mode: <Inventory manager>*.{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\".{0,1000}\"\.\sSecurity\scheck\s\-\sOK\.\sMode\:\s\s\<Inventory\smanager\>.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#contentN/A1010N/AN/AN/AN/A687
19* Connection #*. Connection to "*". Security check - OK. Mode: <Command (command: *)>.{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\".{0,1000}\"\.\sSecurity\scheck\s\-\sOK\.\sMode\:\s\<Command\s\(command\:\s.{0,1000}\)\>greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#contentN/A1010N/AN/AN/AN/A688
20* Connection #*. Direct connection to * (*:5650).*.{0,1000}\sConnection\s\#.{0,1000}\.\sDirect\sconnection\sto\s.{0,1000}\s\(.{0,1000}\:5650\)\..{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#contentN/A1010N/AN/AN/AN/A689
21* create RPCService start=*.{0,1000}\screate\sRPCService\sstart\=.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A725
22* create ViewerService start=auto*.{0,1000}\screate\sViewerService\sstart\=auto.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A726
23* Dameware Mini Remote Control x64 -- Installation completed successfully*.{0,1000}\sDameware\sMini\sRemote\sControl\sx64\s\-\-\sInstallation\scompleted\ssuccessfully.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A776
24* downloads.level.io*.{0,1000}\sdownloads\.level\.io.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A945
25* DownloadServer=https://www.gotomypc.com *.{0,1000}\sDownloadServer\=https\:\/\/www\.gotomypc\.com\s.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A946
26* gotoopener://launch.getgo.com/*.{0,1000}\sgotoopener\:\/\/launch\.getgo\.com\/.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A1366
27* -i remotepc.deb*.{0,1000}\s\-i\sremotepc\.deb.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A1599
28* install meshcentral*.{0,1000}\sinstall\smeshcentral.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z1695
29* install-fleetctl.sh*.{0,1000}\sinstall\-fleetctl\.sh.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z1716
30* LoggingServer=logging.getgo.com ProxyHost=*.{0,1000}\sLoggingServer\=logging\.getgo\.com\sProxyHost\=.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A2036
31* -log-level trace -dre -log-path *.{0,1000}\s\-log\-level\strace\s\-dre\s\-log\-path\s.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A2038
32* meshcentral.service*.{0,1000}\smeshcentral\.service.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z2141
33* -ms assist.zoho.com -p 443*.{0,1000}\s\-ms\sassist\.zoho\.com\s\-p\s443.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A2189
34* -name:* -password:* -remoteexecute -filename*.{0,1000}\s\-name\:.{0,1000}\s\-password\:.{0,1000}\s\-remoteexecute\s\-filename.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A2250
35* -omeshcmd.exe -imodule1.js*.{0,1000}\s\-omeshcmd\.exe\s\-imodule1\.js.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z2439
36* PCMonitorManager.exe*.{0,1000}\sPCMonitorManager\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A2573
37* PCMonitorSrv.exe*.{0,1000}\sPCMonitorSrv\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A2574
38* pcmontask.exe*.{0,1000}\spcmontask\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A2575
39* pulseway_x64.deb*.{0,1000}\spulseway_x64\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A2702
40* Pulseway_x64.msi*.{0,1000}\sPulseway_x64\.msi.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A2703
41* pulseway_x86.deb*.{0,1000}\spulseway_x86\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A2704
42* RemoteDesktop.exe*.{0,1000}\sRemoteDesktop\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A2833
43* RemotePC.exe*.{0,1000}\sRemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A2844
44* RemotePCAttendedService *.{0,1000}\sRemotePCAttendedService\s.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A2845
45* remotepclauncher.exe*.{0,1000}\sremotepclauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A2846
46* remotepcuiu.exe*.{0,1000}\sremotepcuiu\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A2847
47* RemotePCViewer.msi*.{0,1000}\sRemotePCViewer\.msi.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A2848
48* rmm-installer.ps1*.{0,1000}\srmm\-installer\.ps1.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z2911
49* rpcdownloader.exe*.{0,1000}\srpcdownloader\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A2923
50* rpcperfviewer.exe*.{0,1000}\srpcperfviewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A2927
51* RPCWinXP.exe*.{0,1000}\sRPCWinXP\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A2928
52* -rr_flag * -group * -fileTransferGateways *.zohoassist.com -ADMINAGENT*.{0,1000}\s\-rr_flag\s.{0,1000}\s\-group\s.{0,1000}\s\-fileTransferGateways\s.{0,1000}\.zohoassist\.com\s\-ADMINAGENT.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A2929
53* RustDesk.exe*.{0,1000}\sRustDesk\.exe.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z2953
54* SELECT ProcessId FROM Win32_Process * Name='ZAAudioClient.exe'*.{0,1000}\sSELECT\sProcessId\sFROM\sWin32_Process\s.{0,1000}\sName\=\'ZAAudioClient\.exe\'.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A3035
55* -service TightVNC Server*.{0,1000}\s\-service\sTightVNC\sServer.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/AN/A1010N/AN/AN/AN/A3049
56* start rustdesk://*.{0,1000}\sstart\srustdesk\:\/\/.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z3390
57* start SupremoService*.{0,1000}\sstart\sSupremoService.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A3391
58* start uvnc_service*.{0,1000}\sstart\suvnc_service.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A3392
59* stop uvnc_service*.{0,1000}\sstop\suvnc_service.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A3414
60* Supremo.exe*.{0,1000}\sSupremo\.exe.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A3432
61* tacticalrmm.exe*.{0,1000}\stacticalrmm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z3459
62* tkc_agent_dre.deb*.{0,1000}\stkc_agent_dre\.deb.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A3523
63* ultravnc.ini *.{0,1000}\sultravnc\.ini\s.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A3610
64* upload*.systemmonitor.eu.com*/command/agentprocessor*.{0,1000}\supload.{0,1000}\.systemmonitor\.eu\.com.{0,1000}\/command\/agentprocessor.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A3626
65* vnc.ini *.{0,1000}\svnc\.ini\s.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A3673
66* VSAX_x64.msi*.{0,1000}\sVSAX_x64\.msi.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A3679
67* --webview-exe-name=QuickAssist.exe*.{0,1000}\s\-\-webview\-exe\-name\=QuickAssist\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A3700
68* ZA_Connect.exe*.{0,1000}\sZA_Connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A3788
69* ZAAudioClient.exe*.{0,1000}\sZAAudioClient\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A3789
70* ZAFileTransfer.exe*.{0,1000}\sZAFileTransfer\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A3790
71* ZAService.exe*.{0,1000}\sZAService\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A3791
72*"appName":"eHorus Agent"*.{0,1000}\"appName\"\:\"eHorus\sAgent\".{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#registryN/A1010N/AN/AN/AN/A3820
73*"message":"ably connection state: CONNECTED"}*.{0,1000}\"message\"\:\"ably\sconnection\sstate\:\sCONNECTED\"\}.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A3853
74*"publisher":"uvnc bvba*.{0,1000}\"publisher\"\:\"uvnc\sbvba.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry value1010N/AN/AN/AN/A3860
75*"RemotePCAttendedService"*.{0,1000}\"RemotePCAttendedService\".{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A3863
76*"SimpleHelp Remote Printer"*.{0,1000}\"SimpleHelp\sRemote\sPrinter\".{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A3870
77*$EHORUS_HOME/.vnc/passwd*.{0,1000}\$EHORUS_HOME\/\.vnc\/passwd.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A3959
78*$env:LEVEL_API_KEY = "*";*.{0,1000}\$env\:LEVEL_API_KEY\s\=\s\".{0,1000}\"\;.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A3963
79*$outputPath = "C:\AnyDesk.exe"*.{0,1000}\$outputPath\s\=\s\"C\:\\AnyDesk\.exe\".{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://github.com/Ab4y98/VerySimpleAnyDeskBackdoor/blob/main/AnydeskBackdoor.ps110N/Asimple backdoor with anydesk101102025-04-17T19:04:37Z2023-12-05T22:08:51Z4004
80*$tempFile = Join-Path ([System.IO.Path]::GetTempPath()) "install_windows.exe";*.{0,1000}\$tempFile\s\=\sJoin\-Path\s\(\[System\.IO\.Path\]\:\:GetTempPath\(\)\)\s\"install_windows\.exe\"\;.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A4021
81*.\TightVNC1*.{0,1000}\.\\TightVNC1.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10#registryregistry1010N/AN/AN/AN/A4231
82*.\TightVNC2*.{0,1000}\.\\TightVNC2.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10#registryregistry1010N/AN/AN/AN/A4232
83*.\TightVNC3*.{0,1000}\.\\TightVNC3.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10#registryregistry1010N/AN/AN/AN/A4233
84*.api.splashtop.com*.{0,1000}\.api\.splashtop\.com.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7211N/AN/A1010N/AN/AN/AN/A4243
85*.apitest.barracudamsp.com*.{0,1000}\.apitest\.barracudamsp\.com.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm11N/AN/A1010N/AN/AN/AN/A4244
86*.aweray.net*.{0,1000}\.aweray\.net.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com11N/AN/A1010N/AN/AN/AN/A4252
87*.beyondtrustcloud.com/session_complete*.{0,1000}\.beyondtrustcloud\.com\/session_complete.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/11N/AN/A1010N/AN/AN/AN/A4258
88*.chrome-remote-desktop-session*.{0,1000}\.chrome\-remote\-desktop\-session.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A4269
89*.comodo.com/static/frontend/static-pages/enroll-wizard/token*.{0,1000}\.comodo\.com\/static\/frontend\/static\-pages\/enroll\-wizard\/token.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/11N/AN/A1010N/AN/AN/AN/A4275
90*.console.gotoassist.com*.{0,1000}\.console\.gotoassist\.com.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com11N/AN/A1010N/AN/AN/AN/A4279
91*.dev1.fleetdeck.io*.{0,1000}\.dev1\.fleetdeck\.io.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z4285
92*.exe --IPCport 5939 --Module 1*.{0,1000}\.exe\s\-\-IPCport\s5939\s\-\-Module\s1.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/Ahttps://github.com/SigmaHQ/sigma/pull/47591010N/AN/AN/AN/A4487
93*.exe --pn dre_video_uploader --logpath logs*.{0,1000}\.exe\s\-\-pn\sdre_video_uploader\s\-\-logpath\slogs.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A4570
94*.meshagent.pid*.{0,1000}\.meshagent\.pid.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z4701
95*.mspa.n-able.com*.{0,1000}\.mspa\.n\-able\.com.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software11N/AN/A1010N/AN/AN/AN/A4703
96*.relay.splashtop.com*.{0,1000}\.relay\.splashtop\.com.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7211N/AN/A1010N/AN/AN/AN/A4863
97*.remotepc.com*.{0,1000}\.remotepc\.com.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A4864
98*.remotepc.com*.{0,1000}\.remotepc\.com.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/Anetwork1010N/AN/AN/AN/A4865
99*.remoteutilities.com*.{0,1000}\.remoteutilities\.com.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A4866
100*.remoteview.logmein.com*.{0,1000}\.remoteview\.logmein\.com.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com11N/AN/A1010N/AN/AN/AN/A4867
101*.router.teamviewer.com*.{0,1000}\.router\.teamviewer\.com.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/11N/AFP risk - teamviewer usage1010N/AN/AN/AN/A4871
102*.servicedesk.atera.com/GetAgent*.{0,1000}\.servicedesk\.atera\.com\/GetAgent.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/11N/AN/A1010N/AN/AN/AN/A4885
103*.vsax.net*.{0,1000}\.vsax\.net.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A4950
104*.xeox.com*.{0,1000}\.xeox\.com.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/11N/AN/A1010N/AN/AN/AN/A4956
105*.zohoassist.com.cn*.{0,1000}\.zohoassist\.com\.cn.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A4979
106*.zohoassist.jp*.{0,1000}\.zohoassist\.jp.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A4980
107*/.anydesk/.anydesk.trace*.{0,1000}\/\.anydesk\/\.anydesk\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A5004
108*/.anydesk/service.conf*.{0,1000}\/\.anydesk\/service\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A5005
109*/.anydesk/system.conf*.{0,1000}\/\.anydesk\/system\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A5006
110*/.anydesk/user.conf*.{0,1000}\/\.anydesk\/user\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A5007
111*/.fleetctl/fleetctl*.{0,1000}\/\.fleetctl\/fleetctl.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10#linuxN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z5015
112*/action1_agent(My_Organization).msi*.{0,1000}\/action1_agent\(My_Organization\)\.msi.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/11N/Aproduct name1010N/AN/AN/AN/A5123
113*/aeroadmin.exe*.{0,1000}\/aeroadmin\.exe.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A5219
114*/Agent/AcknowledgeCommands/*.{0,1000}\/Agent\/AcknowledgeCommands\/.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A5229
115*/Agent/GetCommandsFallback/*.{0,1000}\/Agent\/GetCommandsFallback\/.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A5231
116*/Agent/GetEnvironmentStatus/*.{0,1000}\/Agent\/GetEnvironmentStatus\/.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A5232
117*/Agent/GetRecurringPackages/*.{0,1000}\/Agent\/GetRecurringPackages\/.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A5233
118*/Alpemix.zip*.{0,1000}\/Alpemix\.zip.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/11N/AN/A1010N/AN/AN/AN/A5281
119*/amidaware/rmmagent/releases/download/*.{0,1000}\/amidaware\/rmmagent\/releases\/download\/.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z5288
120*/Anydesk.exe.{0,1000}\/Anydesk\.exegreyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/11N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A5333
121*/anyplace-control/data2/*.exe*.{0,1000}\/anyplace\-control\/data2\/.{0,1000}\.exe.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com11N/AN/A1010N/AN/AN/AN/A5334
122*/AnyViewerSetup.exe*.{0,1000}\/AnyViewerSetup\.exe.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com11N/AN/A1010N/AN/AN/AN/A5336
123*/Apemix.exe*.{0,1000}\/Apemix\.exe.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/11N/AN/A1010N/AN/AN/AN/A5342
124*/api/latest/fleet/mdm/bootstrap?token=*.{0,1000}\/api\/latest\/fleet\/mdm\/bootstrap\?token\=.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z5350
125*/api/v1/fleet/mdm/sso/callback*.{0,1000}\/api\/v1\/fleet\/mdm\/sso\/callback.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z5365
126*/Applications/Anydesk.app/*.{0,1000}\/Applications\/Anydesk\.app\/.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#macosrisk of false positives - compliance detection1010N/AN/AN/AN/A5383
127*/Applications/Managed Workplace/Onsite Manager/logs/*.{0,1000}\/Applications\/Managed\sWorkplace\/Onsite\sManager\/logs\/.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10#linuxN/A1010N/AN/AN/AN/A5384
128*/Assistance rapide Installer.exe*.{0,1000}\/Assistance\srapide\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx511N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A5428
129*/Assistenza rapida Installer.exe*.{0,1000}\/Assistenza\srapida\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx511N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A5429
130*/AttendedUDP.zip*.{0,1000}\/AttendedUDP\.zip.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A5466
131*/Aweray_Remote_*.exe*.{0,1000}\/Aweray_Remote_.{0,1000}\.exe.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com11N/AN/A1010N/AN/AN/AN/A5505
132*/Aweray_Remote_*.zip*.{0,1000}\/Aweray_Remote_.{0,1000}\.zip.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com11N/AN/A1010N/AN/AN/AN/A5506
133*/bin/meshagent*.{0,1000}\/bin\/meshagent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10#linuxN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z5635
134*/bin/MeshCommander*.{0,1000}\/bin\/MeshCommander.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10#linuxN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z5636
135*/bomgar-rep.exe*.{0,1000}\/bomgar\-rep\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/11N/AN/A1010N/AN/AN/AN/A5761
136*/bomgar-rep-installer.exe*.{0,1000}\/bomgar\-rep\-installer\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A5762
137*/bomgar-scc-*.exe*.{0,1000}\/bomgar\-scc\-.{0,1000}\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/11N/AN/A1010N/AN/AN/AN/A5763
138*/bomgar-scc.exe*.{0,1000}\/bomgar\-scc\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/11N/AN/A1010N/AN/AN/AN/A5764
139*/Create /TN TVInstallRestore /TR *.{0,1000}\/Create\s\/TN\sTVInstallRestore\s\/TR\s.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A6229
140*/damewareagent.exe*.{0,1000}\/damewareagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software11N/AN/A1010N/AN/AN/AN/A6397
141*/downloads/ultravnc.html*.{0,1000}\/downloads\/ultravnc\.html.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html11N/AN/A1010N/AN/AN/AN/A6771
142*/dwagent.desktop*.{0,1000}\/dwagent\.desktop.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10#linuxN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z6857
143*/dwagent.service*.{0,1000}\/dwagent\.service.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10#linuxN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z6858
144*/dwagsystray*.{0,1000}\/dwagsystray.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10#linuxN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z6859
145*/DWMRC_St_64.msi*.{0,1000}\/DWMRC_St_64\.msi.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control11N/ADameware Mini Remote Control1010N/AN/AN/AN/A6860
146*/DWRCC.exe*.{0,1000}\/DWRCC\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control11N/ADameware Mini Remote Control1010N/AN/AN/AN/A6861
147*/DWRCCMD.exe*.{0,1000}\/DWRCCMD\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control11N/ADameware Mini Remote Control1010N/AN/AN/AN/A6862
148*/DWRCS.exe*.{0,1000}\/DWRCS\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control11N/ADameware Mini Remote Control1010N/AN/AN/AN/A6863
149*/ehorus_agent_installer-*.{0,1000}\/ehorus_agent_installer\-.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/11N/AN/A1010N/AN/AN/AN/A6906
150*/etc/ehorus/ehorus_agent*.{0,1000}\/etc\/ehorus\/ehorus_agent.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A6999
151*/etc/fleet/fleet.env*.{0,1000}\/etc\/fleet\/fleet\.env.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10#linuxN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z7000
152*/etc/init.d/ehorus_agent_daemon*.{0,1000}\/etc\/init\.d\/ehorus_agent_daemon.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A7002
153*/etc/level/config.yaml*.{0,1000}\/etc\/level\/config\.yaml.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A7011
154*/etc/pulseway/config.xml*.{0,1000}\/etc\/pulseway\/config\.xml.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10#linuxN/A1010N/AN/AN/AN/A7017
155*/etc/systemd/system/anydesk.service*.{0,1000}\/etc\/systemd\/system\/anydesk\.service.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A7026
156*/fleet_v*_linux.tar.gz*.{0,1000}\/fleet_v.{0,1000}_linux\.tar\.gz.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11#linuxN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z7216
157*/fleetd.crx*.{0,1000}\/fleetd\.crx.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z7217
158*/fleetdm/fleet/releases/download/*.{0,1000}\/fleetdm\/fleet\/releases\/download\/.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z7218
159*/fleetdm/fleet/releases/latest*.{0,1000}\/fleetdm\/fleet\/releases\/latest.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z7219
160*/home/*/.anydesk/*.{0,1000}\/home\/.{0,1000}\/\.anydesk\/.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A7790
161*/home/user/rustdesk*.{0,1000}\/home\/user\/rustdesk.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10#linuxN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z7801
162*/host-7.2.2.0.msi*.{0,1000}\/host\-7\.2\.2\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A7810
163*/HVNC.git*.{0,1000}\/HVNC\.git.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC11N/AN/A1054451332025-03-27T21:20:10Z2021-09-03T17:34:44Z7984
164*/install-fleetctl.sh*.{0,1000}\/install\-fleetctl\.sh.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z8101
165*/level-windows-amd64.exe*.{0,1000}\/level\-windows\-amd64\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/11N/AN/A1010N/AN/AN/AN/A8492
166*/level-windows-arm64.exe*.{0,1000}\/level\-windows\-arm64\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/11N/AN/A1010N/AN/AN/AN/A8493
167*/Library/Logs/SPLog.txt*.{0,1000}\/Library\/Logs\/SPLog\.txt.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10#linuxN/A1010N/AN/AN/AN/A8507
168*/LMI_Rescue.exe*.{0,1000}\/LMI_Rescue\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com11N/AN/A1010N/AN/AN/AN/A8558
169*/LMIRTechConsole.exe*.{0,1000}\/LMIRTechConsole\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com11N/AN/A1010N/AN/AN/AN/A8559
170*/log/anydesk.trace*.{0,1000}\/log\/anydesk\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A8608
171*/MeshAgent --*.{0,1000}\/MeshAgent\s\-\-.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10#linuxN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z8774
172*/MeshAgent.git*.{0,1000}\/MeshAgent\.git.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent11N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z8775
173*/MeshCentral.git*.{0,1000}\/MeshCentral\.git.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral11N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z8776
174*/meshcentral.service*.{0,1000}\/meshcentral\.service.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10#linuxN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z8777
175*/meshinstall.sh*.{0,1000}\/meshinstall\.sh.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral11N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z8778
176*/meshinstall-bsd-rcd.sh*.{0,1000}\/meshinstall\-bsd\-rcd\.sh.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral11N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z8779
177*/nats-rmm.conf*.{0,1000}\/nats\-rmm\.conf.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z9019
178*/nspowershell.exe*.{0,1000}\/nspowershell\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/11N/AN/A1010N/AN/AN/AN/A9264
179*/nssadmui.exe*.{0,1000}\/nssadmui\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/11N/AN/A1010N/AN/AN/AN/A9265
180*/pcictlui.exe*.{0,1000}\/pcictlui\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A9571
181*/PCIDEPLY.exe*.{0,1000}\/PCIDEPLY\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A9572
182*/PCMonitorManager.exe*.{0,1000}\/PCMonitorManager\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A9573
183*/PCMonitorSrv.exe*.{0,1000}\/PCMonitorSrv\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A9574
184*/pcmontask.exe*.{0,1000}\/pcmontask\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/11N/AN/A1010N/AN/AN/AN/A9575
185*/pcmrdp-client.dll*.{0,1000}\/pcmrdp\-client\.dll.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A9576
186*/pulseway_x64.deb*.{0,1000}\/pulseway_x64\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A10002
187*/Pulseway_x64.msi*.{0,1000}\/Pulseway_x64\.msi.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A10003
188*/pulseway_x86.deb*.{0,1000}\/pulseway_x86\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A10004
189*/Quasar.git*.{0,1000}\/Quasar\.git.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar11N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z10125
190*/Quasar.v*.zip*.{0,1000}\/Quasar\.v.{0,1000}\.zip.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar11N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z10126
191*/Quasar/releases*.{0,1000}\/Quasar\/releases.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar11N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z10127
192*/Quick Assist Installer.exe*.{0,1000}\/Quick\sAssist\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx511N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A10129
193*/Quick%20Assist%20Installer.exe*.{0,1000}\/Quick\%20Assist\%20Installer\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx511N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A10130
194*/Radmin.exe*.{0,1000}\/Radmin\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A10142
195*/Radmin_Server_*.msi*.{0,1000}\/Radmin_Server_.{0,1000}\.msi.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A10143
196*/Radmin_Viewer_*.msi*.{0,1000}\/Radmin_Viewer_.{0,1000}\.msi.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A10144
197*/Radmin_VPN_1.*.exe*.{0,1000}\/Radmin_VPN_1\..{0,1000}\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A10145
198*/RemoteControlSetup.exe*.{0,1000}\/RemoteControlSetup\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/11N/AN/A1010N/AN/AN/AN/A10369
199*/RemoteDesktop.exe*.{0,1000}\/RemoteDesktop\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/11N/AN/A1010N/AN/AN/AN/A10370
200*/remotepc.deb*.{0,1000}\/remotepc\.deb.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A10384
201*/remotepc.deb*.{0,1000}\/remotepc\.deb.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10385
202*/RemotePC.exe*.{0,1000}\/RemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A10386
203*/RemotePC.exe*.{0,1000}\/RemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10387
204*/RemotePC.lnk*.{0,1000}\/RemotePC\.lnk.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10388
205*/RemotePC.tmp*.{0,1000}\/RemotePC\.tmp.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10389
206*/remotepc-attended.deb*.{0,1000}\/remotepc\-attended\.deb.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A10390
207*/RemotePCAttended.dmg*.{0,1000}\/RemotePCAttended\.dmg.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11#macosN/A1010N/AN/AN/AN/A10391
208*/remotepclauncher.exe*.{0,1000}\/remotepclauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10392
209*/RemotePCSuite.dmg*.{0,1000}\/RemotePCSuite\.dmg.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11#macosN/A1010N/AN/AN/AN/A10393
210*/remotepcuiu.exe*.{0,1000}\/remotepcuiu\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10394
211*/RemotePCViewer.msi*.{0,1000}\/RemotePCViewer\.msi.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A10395
212*/rfusclient.exe*.{0,1000}\/rfusclient\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A10472
213*/rmm/api/tacticalrmm/*.{0,1000}\/rmm\/api\/tacticalrmm\/.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z10487
214*/rmm-installer.ps1*.{0,1000}\/rmm\-installer\.ps1.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z10488
215*/RpcDND_Console.exe*.{0,1000}\/RpcDND_Console\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10540
216*/rpcdownloader.exe*.{0,1000}\/rpcdownloader\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10541
217*/RPCFireWallRule.exe*.{0,1000}\/RPCFireWallRule\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10545
218*/rpcperfviewer.exe*.{0,1000}\/rpcperfviewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10549
219*/RPCProxyLatency.exe*.{0,1000}\/RPCProxyLatency\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A10550
220*/rserver3.exe*.{0,1000}\/rserver3\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A10554
221*/RustDesk.exe*.{0,1000}\/RustDesk\.exe.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk11N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z10639
222*/rustdesk.git*.{0,1000}\/rustdesk\.git.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk11N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z10640
223*/rustdesk/rustdesk/releases/*.{0,1000}\/rustdesk\/rustdesk\/releases\/.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk11N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z10641
224*/rutserv.exe*.{0,1000}\/rutserv\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A10649
225*/rutview.exe*.{0,1000}\/rutview\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A10650
226*/simplehelper64.exe*.{0,1000}\/simplehelper64\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com11N/AN/A1010N/AN/AN/AN/A11275
227*/SolarWinds-Dameware-DRS-St.exe*.{0,1000}\/SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software11N/ADameware Remote Support1010N/AN/AN/AN/A11502
228*/SplashtopStreamer/SPLog.txt*.{0,1000}\/SplashtopStreamer\/SPLog\.txt.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10#linuxN/A1010N/AN/AN/AN/A11528
229*/Supremo.exe*.{0,1000}\/Supremo\.exe.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com11N/AN/A1010N/AN/AN/AN/A11736
230*/system/chrome-remote-desktop@*.{0,1000}\/system\/chrome\-remote\-desktop\@.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10#linuxN/A1010N/AN/AN/AN/A11765
231*/system/meshagent*.{0,1000}\/system\/meshagent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10#linuxN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z11766
232*/system/MeshCommander*.{0,1000}\/system\/MeshCommander.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10#linuxN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z11767
233*/systemd/system/pulseway.service*.{0,1000}\/systemd\/system\/pulseway\.service.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A11770
234*/tacticalagent.log*.{0,1000}\/tacticalagent\.log.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10#linuxN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11778
235*/tacticalagent-v*-*.exe*.{0,1000}\/tacticalagent\-v.{0,1000}\-.{0,1000}\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11779
236*/tacticalagent-v*-linux-arm.exe*.{0,1000}\/tacticalagent\-v.{0,1000}\-linux\-arm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11#linuxN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11780
237*/tacticalagent-v*-windows-amd64.exe*.{0,1000}\/tacticalagent\-v.{0,1000}\-windows\-amd64\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11781
238*/tacticalrmm.exe*.{0,1000}\/tacticalrmm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11782
239*/tacticalrmm.git*.{0,1000}\/tacticalrmm\.git.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11783
240*/tacticalrmm/master/install.sh*.{0,1000}\/tacticalrmm\/master\/install\.sh.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11784
241*/tacticalrmm/releases/latest*.{0,1000}\/tacticalrmm\/releases\/latest.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11785
242*/tacticalrmm-web.git*.{0,1000}\/tacticalrmm\-web\.git.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z11786
243*/tightvnc-*.msi*.{0,1000}\/tightvnc\-.{0,1000}\.msi.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com11N/AN/A1010N/AN/AN/AN/A11919
244*/tkc_agent_dre.deb*.{0,1000}\/tkc_agent_dre\.deb.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software11N/AN/A1010N/AN/AN/AN/A11931
245*/tmp/*/enroll.sh*.{0,1000}\/tmp\/.{0,1000}\/enroll\.sh.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#linuxN/A1010N/AN/AN/AN/A11941
246*/tmp/*/itsm.service*.{0,1000}\/tmp\/.{0,1000}\/itsm\.service.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#linuxN/A1010N/AN/AN/AN/A11942
247*/tmp/*/itsm-linux*.{0,1000}\/tmp\/.{0,1000}\/itsm\-linux.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#linuxN/A1010N/AN/AN/AN/A11943
248*/tmp/fleet_remove_log.txt*.{0,1000}\/tmp\/fleet_remove_log\.txt.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10#linuxN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z11970
249*/usr/bin/anydesk*.{0,1000}\/usr\/bin\/anydesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A12262
250*/usr/bin/ehorus_agent*.{0,1000}\/usr\/bin\/ehorus_agent.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A12267
251*/usr/bin/r-agent*.{0,1000}\/usr\/bin\/r\-agent.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#linuxlinux1010N/AN/AN/AN/A12340
252*/usr/bin/r-viewer*.{0,1000}\/usr\/bin\/r\-viewer.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#linuxlinux1010N/AN/AN/AN/A12342
253*/usr/lib64/anydesk*.{0,1000}\/usr\/lib64\/anydesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A12345
254*/usr/libexec/anydesk*.{0,1000}\/usr\/libexec\/anydesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A12346
255*/usr/local/bin/level*.{0,1000}\/usr\/local\/bin\/level.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A12351
256*/usr/sbin/pulseway*.{0,1000}\/usr\/sbin\/pulseway.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10#linuxN/A1010N/AN/AN/AN/A12361
257*/usr/sbin/pulsewayd*.{0,1000}\/usr\/sbin\/pulsewayd.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10#linuxN/A1010N/AN/AN/AN/A12362
258*/usr/sbin/userdel -r ehorus*.{0,1000}\/usr\/sbin\/userdel\s\-r\sehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A12364
259*/usr/share/applications/r-agent.desktop*.{0,1000}\/usr\/share\/applications\/r\-agent\.desktop.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#linuxlinux1010N/AN/AN/AN/A12365
260*/usr/share/applications/r-viewer.desktop*.{0,1000}\/usr\/share\/applications\/r\-viewer\.desktop.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#linuxlinux1010N/AN/AN/AN/A12366
261*/usr/share/ehorus*.{0,1000}\/usr\/share\/ehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A12373
262*/var/lib/level/level.db*.{0,1000}\/var\/lib\/level\/level\.db.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A12397
263*/var/lib/level/level.log*.{0,1000}\/var\/lib\/level\/level\.log.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A12398
264*/var/log/ehorus_agent.log*.{0,1000}\/var\/log\/ehorus_agent\.log.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#logfile #linuxN/A1010N/AN/AN/AN/A12403
265*/viewerhostkeypopup.exe*.{0,1000}\/viewerhostkeypopup\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A12446
266*/VPDAgent.exe*.{0,1000}\/VPDAgent\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A12482
267*/VSAX_x64.msi*.{0,1000}\/VSAX_x64\.msi.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/11N/AN/A1010N/AN/AN/AN/A12483
268*/vsxrc-clip.exe*.{0,1000}\/vsxrc\-clip\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/11N/AN/A1010N/AN/AN/AN/A12486
269*/Win7Taskbar.dll*.{0,1000}\/Win7Taskbar\.dll.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/11N/AN/A1010N/AN/AN/AN/A12585
270*/ZA_Connect.exe*.{0,1000}\/ZA_Connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A12802
271*/ZAAudioClient.exe*.{0,1000}\/ZAAudioClient\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A12803
272*/ZAFileTransfer.exe*.{0,1000}\/ZAFileTransfer\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A12804
273*/ZAService.exe*.{0,1000}\/ZAService\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A12805
274*:8040/SetupWizard.aspx*.{0,1000}\:8040\/SetupWizard\.aspx.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download11N/AN/A1010N/AN/AN/AN/A12861
275*:9001/proxy/mdmserver1/account*.{0,1000}\:9001\/proxy\/mdmserver1\/account.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z12866
276*\*-*-*_rut-*.zip.3bf*[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}_rut-[0-9]\.[0-9]\.[0-9]\.[0-9]\.zip\.3bfgreyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A13549
277*\*-internet-id-log.csv*.{0,1000}\\.{0,1000}\-internet\-id\-log\.csv.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A13555
278*\.dwagent\*.{0,1000}\\\.dwagent\\.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z13563
279*\.rustdesk*.{0,1000}\\\.rustdesk.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z13567
280*\\.\pipe\orbit-osquery-extension*.{0,1000}\\\\\.\\pipe\\orbit\-osquery\-extension.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10#namedpipeN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z13595
281*\\.\pipe\Supremo*.{0,1000}\\\\\.\\pipe\\Supremo.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#namedpipeN/A1010N/AN/AN/AN/A13603
282*\\MeshAgent*.{0,1000}\\\\MeshAgent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z13666
283*\\RustDeskIddDriver*.{0,1000}\\\\RustDeskIddDriver.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z13684
284*\127.0.0.1-5900.vnc*.{0,1000}\\127\.0\.0\.1\-5900\.vnc.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A13716
285*\aa_nts.dll*.{0,1000}\\aa_nts\.dll.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A13768
286*\AA_v3.exe*.{0,1000}\\AA_v3\.exe.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A13769
287*\AA_v3.log*.{0,1000}\\AA_v3\.log.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A13770
288*\Action1\7z.dll*.{0,1000}\\Action1\\7z\.dll.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A13781
289*\Action1\Agent\Certificate*.{0,1000}\\Action1\\Agent\\Certificate.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A13782
290*\Action1\CrashDumps*.{0,1000}\\Action1\\CrashDumps.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A13783
291*\Action1\package_downloads*.{0,1000}\\Action1\\package_downloads.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A13784
292*\Action1\scripts\Run_PowerShell_*.{0,1000}\\Action1\\scripts\\Run_PowerShell_.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A13785
293*\action1_agent(My_Organization).msi*.{0,1000}\\action1_agent\(My_Organization\)\.msi.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/Aproduct name1010N/AN/AN/AN/A13786
294*\ACTION1_AGENT.EXE-*.{0,1000}\\ACTION1_AGENT\.EXE\-.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A13787
295*\action1_log_*.log*.{0,1000}\\action1_log_.{0,1000}\.log.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/Aexample C:\Windows\Action1\logs\action1_log_2023-12-17_13-42-47~10328.log1010N/AN/AN/AN/A13788
296*\ad_svc.trace*.{0,1000}\\ad_svc\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.inversecos.com/2021/02/forensic-analysis-of-anydesk-logs.html10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13790
297*\ADM Templates\ADMX\*.admx*.{0,1000}\\ADM\sTemplates\\ADMX\\.{0,1000}\.admx.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A13852
298*\adprinterpipe*.{0,1000}\\adprinterpipe.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13864
299*\Advanced Monitoring Agent\debug.log*.{0,1000}\\Advanced\sMonitoring\sAgent\\debug\.log.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A13874
300*\Advanced Monitoring Agent\staging*.{0,1000}\\Advanced\sMonitoring\sAgent\\staging.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A13875
301*\Advanced Monitoring Agent\task_start.js*.{0,1000}\\Advanced\sMonitoring\sAgent\\task_start\.js.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A13876
302*\Advanced Monitoring Agent\unzip.exe*.{0,1000}\\Advanced\sMonitoring\sAgent\\unzip\.exe.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A13877
303*\Advanced Monitoring Agent\winagent.exe*.{0,1000}\\Advanced\sMonitoring\sAgent\\winagent\.exe.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A13878
304*\AeroAdmin *_Portable.exe*.{0,1000}\\AeroAdmin\s.{0,1000}_Portable\.exe.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A13883
305*\aeroadmin.exe*.{0,1000}\\aeroadmin\.exe.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A13884
306*\Aeroadmin.lnk*.{0,1000}\\Aeroadmin\.lnk.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A13885
307*\Aeroadmin\black.bmp*.{0,1000}\\Aeroadmin\\black\.bmp.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A13886
308*\Alpemix.ini*.{0,1000}\\Alpemix\.ini.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A13902
309*\Alpemix.zip*.{0,1000}\\Alpemix\.zip.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A13903
310*\AlphaControlAgent\obj\Release\AteraAgent.pdb*.{0,1000}\\AlphaControlAgent\\obj\\Release\\AteraAgent\.pdb.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A13904
311*\AMMYY\access.log*.{0,1000}\\AMMYY\\access\.log.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A13909
312*\AnyDesk (1).exe*.{0,1000}\\AnyDesk\s\(1\)\.exe.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13952
313*\AnyDesk.exe*.{0,1000}\\AnyDesk\.exe.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13953
314*\AnyDesk.lnk*.{0,1000}\\AnyDesk\.lnk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13954
315*\AnyDesk\ad.trace*.{0,1000}\\AnyDesk\\ad\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13955
316*\AnyDesk\ad_svc.trace*.{0,1000}\\AnyDesk\\ad_svc\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13956
317*\AnyDesk\AnyDesk_Output.txt*.{0,1000}\\AnyDesk\\AnyDesk_Output\.txt.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://github.com/Ab4y98/VerySimpleAnyDeskBackdoor/blob/main/AnydeskBackdoor.ps110N/Asimple backdoor with anydesk101102025-04-17T19:04:37Z2023-12-05T22:08:51Z13957
318*\AnyDesk\connection_trace.txt*.{0,1000}\\AnyDesk\\connection_trace\.txt.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13958
319*\AnyDesk\connection_trace.txt*.{0,1000}\\AnyDesk\\connection_trace\.txt.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13959
320*\anydesk\printer_driver*.{0,1000}\\anydesk\\printer_driver.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13960
321*\AnyDesk\service.conf*.{0,1000}\\AnyDesk\\service\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13961
322*\AnyDeskPrintDriver.cat*.{0,1000}\\AnyDeskPrintDriver\.cat.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13962
323*\anydeskprintdriver.inf*.{0,1000}\\anydeskprintdriver\.inf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A13963
324*\Anyplace Control - Admin.lnk*.{0,1000}\\Anyplace\sControl\s\-\sAdmin\.lnk.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A13964
325*\Anyplace Control\*.{0,1000}\\Anyplace\sControl\\.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A13965
326*\anyplace-control.ini*.{0,1000}\\anyplace\-control\.ini.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A13966
327*\AnyViewerSetup.exe*.{0,1000}\\AnyViewerSetup\.exe.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A13967
328*\AnyViewerSetup.tmp*.{0,1000}\\AnyViewerSetup\.tmp.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A13968
329*\Apemix.exe*.{0,1000}\\Apemix\.exe.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A13973
330*\AppData\Local\*\rescue.log*.{0,1000}\\AppData\\Local\\.{0,1000}\\rescue\.log.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A13981
331*\appdata\local\bomgar\bomgar-rep\*.{0,1000}\\appdata\\local\\bomgar\\bomgar\-rep\\.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A13982
332*\appdata\local\damewa~1\*.{0,1000}\\appdata\\local\\damewa\~1\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A13986
333*\appdata\local\dameware remote everywhere*.{0,1000}\\appdata\\local\\dameware\sremote\severywhere.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A13987
334*\AppData\Local\Downloaded Installations\*\server-3.3.5.0.msi*.{0,1000}\\AppData\\Local\\Downloaded\sInstallations\\.{0,1000}\\server\-3\.3\.5\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A13988
335*\AppData\Local\Downloaded Installations\*\viewer-7.2.2.0.msi*.{0,1000}\\AppData\\Local\\Downloaded\sInstallations\\.{0,1000}\\viewer\-7\.2\.2\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A13989
336*\AppData\Local\GoToMyPC\*.{0,1000}\\AppData\\Local\\GoToMyPC\\.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A13990
337*\AppData\Local\LMIR*.tmp.bat*.{0,1000}\\AppData\\Local\\LMIR.{0,1000}\.tmp\.bat.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A13991
338*\AppData\Local\LogMeIn Rescue Applet\*.{0,1000}\\AppData\\Local\\LogMeIn\sRescue\sApplet\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A13992
339*\appdata\local\microsoft\windows\inetcache\ie\can_install_pc[1].xml*.{0,1000}\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\can_install_pc\[1\]\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A13996
340*\AppData\Local\rustdesk\*.{0,1000}\\AppData\\Local\\rustdesk\\.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z13998
341*\AppData\Local\Temp\*\gosetup.exe*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\gosetup\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A14000
342*\AppData\Local\Temp\*\GoToOpener.msi*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\GoToOpener\.msi.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A14001
343*\AppData\Local\Temp\*\NSM.LIC*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\NSM\.LIC.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A14003
344*\AppData\Local\Temp\*\server-3.3.5.0.exe*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\server\-3\.3\.5\.0\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A14008
345*\AppData\Local\Temp\*\server-3.3.5.0.msi*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\server\-3\.3\.5\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A14009
346*\AppData\Local\Temp\*\zmstage.exe*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\zmstage\.exe.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A14010
347*\AppData\Local\Temp\*_Radmin_3.*.zip*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}_Radmin_3\..{0,1000}\.zip.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A14011
348*\AppData\Local\Temp\dwagent*.{0,1000}\\AppData\\Local\\Temp\\dwagent.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z14017
349*\AppData\Local\Temp\ITarian_Remote_Access_*.{0,1000}\\AppData\\Local\\Temp\\ITarian_Remote_Access_.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A14026
350*\AppData\Local\Temp\Remote_Control_by_Itarian*.{0,1000}\\AppData\\Local\\Temp\\Remote_Control_by_Itarian.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A14044
351*\AppData\Local\Temp\RemoteHelp\EBWebView*.{0,1000}\\AppData\\Local\\Temp\\RemoteHelp\\EBWebView.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A14045
352*\AppData\Local\Temp\rutserv*.{0,1000}\\AppData\\Local\\Temp\\rutserv.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A14046
353*\AppData\Local\ZohoMeeting\*.{0,1000}\\AppData\\Local\\ZohoMeeting\\.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A14066
354*\AppData\LocalLow\LogMeIn Rescue\*.{0,1000}\\AppData\\LocalLow\\LogMeIn\sRescue\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A14067
355*\AppData\Roaming\*\remote.nsm*.{0,1000}\\AppData\\Roaming\\.{0,1000}\\remote\.nsm.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A14068
356*\AppData\Roaming\*\RemoteDesktop.exe*.{0,1000}\\AppData\\Roaming\\.{0,1000}\\RemoteDesktop\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A14069
357*\AppData\Roaming\*\uac.tmp.{0,1000}\\AppData\\Roaming\\.{0,1000}\\uac\.tmpgreyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A14070
358*\AppData\Roaming\*-5900.vnc*.{0,1000}\\AppData\\Roaming\\.{0,1000}\-5900\.vnc.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A14071
359*\appdata\roaming\*'DestPort'>4782</Data>*.{0,1000}\\appdata\\roaming\\.{0,1000}\'DestPort\'\>4782\<\/Data\>.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z14072
360*\AppData\Roaming\AnyDesk\system.conf*.{0,1000}\\AppData\\Roaming\\AnyDesk\\system\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A14073
361*\AppData\Roaming\AnyDesk\user.conf*.{0,1000}\\AppData\\Roaming\\AnyDesk\\user\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A14074
362*\AppData\Roaming\Anyplace Control*.{0,1000}\\AppData\\Roaming\\Anyplace\sControl.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A14075
363*\AppData\Roaming\DameWare Development\*.{0,1000}\\AppData\\Roaming\\DameWare\sDevelopment\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14076
364*\AppData\Roaming\freerdp*.{0,1000}\\AppData\\Roaming\\freerdp.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A14078
365*\AppData\Roaming\NetSupport\*.{0,1000}\\AppData\\Roaming\\NetSupport\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A14085
366*\AppData\Roaming\Radmin*.{0,1000}\\AppData\\Roaming\\Radmin.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A14086
367*\AppData\Roaming\Remote Utilities Files*.{0,1000}\\AppData\\Roaming\\Remote\sUtilities\sFiles.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A14089
368*\AppData\Roaming\TeamViewer*.{0,1000}\\AppData\\Roaming\\TeamViewer.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A14091
369*\AppData\Roaming\UltraVNC\*.{0,1000}\\AppData\\Roaming\\UltraVNC\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A14093
370*\AppData\Roaming\VSA X*.{0,1000}\\AppData\\Roaming\\VSA\sX.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A14094
371*\Assistance rapide Installer.exe*.{0,1000}\\Assistance\srapide\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A14122
372*\Assistenza rapida Installer.exe*.{0,1000}\\Assistenza\srapida\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A14123
373*\atera_agent.exe*.{0,1000}\\atera_agent\.exe.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A14128
374*\AttendedServiceRemove.exe*.{0,1000}\\AttendedServiceRemove\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A14141
375*\AttendedUDP.zip*.{0,1000}\\AttendedUDP\.zip.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A14142
376*\Aweray Remote.lnk*.{0,1000}\\Aweray\sRemote\.lnk.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A14176
377*\Aweray_Remote_*.exe*.{0,1000}\\Aweray_Remote_.{0,1000}\.exe.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A14177
378*\Aweray_Remote_*.zip*.{0,1000}\\Aweray_Remote_.{0,1000}\.zip.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A14178
379*\AweSun.exe*.{0,1000}\\AweSun\.exe.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A14179
380*\baconsoleapp.exe*.{0,1000}\\baconsoleapp\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14209
381*\baconsoleappen.dll*.{0,1000}\\baconsoleappen\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14210
382*\baseclient.exe* -consoleinstallcomplete*.{0,1000}\\baseclient\.exe.{0,1000}\s\-consoleinstallcomplete.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14231
383*\basupclphlp.exe*.{0,1000}\\basupclphlp\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14233
384*\basupclpprg.exe*.{0,1000}\\basupclpprg\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14234
385*\basupconhelper.exe*.{0,1000}\\basupconhelper\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14235
386*\basuplib.dll*.{0,1000}\\basuplib\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14236
387*\basupportexpresssrvcupdater_dameware*.{0,1000}\\basupportexpresssrvcupdater_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14237
388*\basupportexpressstandaloneservice_dameware*.{0,1000}\\basupportexpressstandaloneservice_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14238
389*\basupregedithlpr.exe*.{0,1000}\\basupregedithlpr\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14239
390*\basupregedithlpr_*.log*.{0,1000}\\basupregedithlpr_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14240
391*\basupsrvc.cfg*.{0,1000}\\basupsrvc\.cfg.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14241
392*\basupsrvc.exe*.{0,1000}\\basupsrvc\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14242
393*\basupsrvc.ico*.{0,1000}\\basupsrvc\.ico.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14243
394*\basupsrvc.ini*.{0,1000}\\basupsrvc\.ini.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14244
395*\basupsrvc.xml*.{0,1000}\\basupsrvc\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14245
396*\basupsrvc_*.log*.{0,1000}\\basupsrvc_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14246
397*\basupsrvccnfg.exe*.{0,1000}\\basupsrvccnfg\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14247
398*\basupsrvccnfg_*.log*.{0,1000}\\basupsrvccnfg_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14248
399*\basupsrvccnfg_dameware*.{0,1000}\\basupsrvccnfg_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14249
400*\basupsrvccnfgde.dll*.{0,1000}\\basupsrvccnfgde\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14250
401*\basupsrvccnfgen.dll*.{0,1000}\\basupsrvccnfgen\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14251
402*\basupsrvccnfges.dll*.{0,1000}\\basupsrvccnfges\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14252
403*\basupsrvccnfgfr.dll*.{0,1000}\\basupsrvccnfgfr\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14253
404*\basupsrvccnfgit.dll*.{0,1000}\\basupsrvccnfgit\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14254
405*\basupsrvccnfgpt.dll*.{0,1000}\\basupsrvccnfgpt\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14255
406*\basupsrvcde.dll*.{0,1000}\\basupsrvcde\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14256
407*\basupsrvcen.dll*.{0,1000}\\basupsrvcen\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14257
408*\basupsrvces.dll*.{0,1000}\\basupsrvces\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14258
409*\basupsrvcevnt3.dll*.{0,1000}\\basupsrvcevnt3\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14259
410*\basupsrvcfr.dll*.{0,1000}\\basupsrvcfr\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14260
411*\basupsrvcit.dll*.{0,1000}\\basupsrvcit\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14261
412*\basupsrvcpt.dll*.{0,1000}\\basupsrvcpt\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14262
413*\basupsrvcupdater.exe*.{0,1000}\\basupsrvcupdater\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14263
414*\basupsrvcupdater_*.log*.{0,1000}\\basupsrvcupdater_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14264
415*\basupsysinf*.log*.{0,1000}\\basupsysinf.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14265
416*\basupsysinf.exe*.{0,1000}\\basupsysinf\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14266
417*\basupsysinf.ini*.{0,1000}\\basupsysinf\.ini.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14267
418*\basupsysshell.exe*.{0,1000}\\basupsysshell\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14268
419*\basupsysshell64.exe*.{0,1000}\\basupsysshell64\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14269
420*\basuptshelper.exe*.{0,1000}\\basuptshelper\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14270
421*\basuptshelper_*.log*.{0,1000}\\basuptshelper_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14271
422*\basuptshelperlib.dll*.{0,1000}\\basuptshelperlib\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14272
423*\basupunelev.exe*.{0,1000}\\basupunelev\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14273
424*\basupvista.dll*.{0,1000}\\basupvista\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14274
425*\bavideochat.exe*.{0,1000}\\bavideochat\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14277
426*\bawhook.dll*.{0,1000}\\bawhook\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14278
427*\beanywhere support express service - [dameware]*.{0,1000}\\beanywhere\ssupport\sexpress\sservice\s\-\s\[dameware\].{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14286
428*\Bomgar-enum_cp-*.{0,1000}\\Bomgar\-enum_cp\-.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14365
429*\bomgar-rep.cache\*.{0,1000}\\bomgar\-rep\.cache\\.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14366
430*\bomgar-rep.exe*.{0,1000}\\bomgar\-rep\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14367
431*\bomgar-rep-installer.exe*.{0,1000}\\bomgar\-rep\-installer\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14368
432*\bomgar-scc-*.exe*.{0,1000}\\bomgar\-scc\-.{0,1000}\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14369
433*\bomgar-scc.exe*.{0,1000}\\bomgar\-scc\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14370
434*\BOMGAR-SCC.EXE-*.{0,1000}\\BOMGAR\-SCC\.EXE\-.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14371
435*\BRMM_2024.1-Release*.{0,1000}\\BRMM_2024\.1\-Release.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A14383
436*\BSUtility.exe*.{0,1000}\\BSUtility\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A14408
437*\cbhook-x86.dll*.{0,1000}\\cbhook\-x86\.dll.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14472
438*\Chrome Remote Desktop\host.json*.{0,1000}\\Chrome\sRemote\sDesktop\\host\.json.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A14511
439*\Citrix\GoToMyPc\FileTransfer\history*.{0,1000}\\Citrix\\GoToMyPc\\FileTransfer\\history.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A14531
440*\Citrix\GoToMyPc\GuestInvite*.{0,1000}\\Citrix\\GoToMyPc\\GuestInvite.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A14532
441*\ComodoRemoteControl.exe*.{0,1000}\\ComodoRemoteControl\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A14597
442*\config\RustDesk.toml*.{0,1000}\\config\\RustDesk\.toml.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z14602
443*\config\RustDesk_local.*.{0,1000}\\config\\RustDesk_local\..{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z14603
444*\Control\Print\Monitors\REMOTEPCPRINTER*.{0,1000}\\Control\\Print\\Monitors\\REMOTEPCPRINTER.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A14622
445*\Control\SafeBoot\Network\SupremoService*.{0,1000}\\Control\\SafeBoot\\Network\\SupremoService.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#registryregistry1010N/AN/AN/AN/A14623
446*\ControlSet001\Control\SafeBoot\Network\AmmyyAdmin_*.{0,1000}\\ControlSet001\\Control\\SafeBoot\\Network\\AmmyyAdmin_.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10#registryN/A1010N/AN/AN/AN/A14624
447*\ControlSet001\Services\AnyDesk*.{0,1000}\\ControlSet001\\Services\\AnyDesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A14625
448*\createpassword.exe*.{0,1000}\\createpassword\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A14652
449*\CurrentControlSet\Control\SafeBoot\Network\AeroadminService*.{0,1000}\\CurrentControlSet\\Control\\SafeBoot\\Network\\AeroadminService.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10#registryN/A1010N/AN/AN/AN/A14706
450*\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (*.{0,1000}\\CurrentControlSet\\Control\\SafeBoot\\Network\\ScreenConnect\sClient\s\(.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10#registryN/A1010N/AN/AN/AN/A14708
451*\CurrentControlSet\Services\AeroadminService*.{0,1000}\\CurrentControlSet\\Services\\AeroadminService.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10#registryN/A1010N/AN/AN/AN/A14709
452*\CurrentControlSet\Services\AlpemixSrvcx*.{0,1000}\\CurrentControlSet\\Services\\AlpemixSrvcx.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10#registryN/A1010N/AN/AN/AN/A14710
453*\CurrentControlSet\Services\bam\State\UserSettings\*\MicrosoftCorporationII.QuickAssist_*.{0,1000}\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\.{0,1000}\\MicrosoftCorporationII\.QuickAssist_.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510#registryQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A14712
454*\CurrentControlSet\Services\ItsmRsp*.{0,1000}\\CurrentControlSet\\Services\\ItsmRsp.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#servicename #registryN/A1010N/AN/AN/AN/A14714
455*\CurrentControlSet\Services\ITSMService*.{0,1000}\\CurrentControlSet\\Services\\ITSMService.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#servicename #registryN/A1010N/AN/AN/AN/A14715
456*\CurrentControlSet\Services\Mesh*.{0,1000}\\CurrentControlSet\\Services\\Mesh.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10#registryN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z14716
457*\CurrentControlSet\Services\MiniInternetIdService*.{0,1000}\\CurrentControlSet\\Services\\MiniInternetIdService.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A14717
458*\CurrentControlSet\Services\RmmService*.{0,1000}\\CurrentControlSet\\Services\\RmmService.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#servicename #registryN/A1010N/AN/AN/AN/A14719
459*\CurrentControlSet\Services\ScreenConnect *.{0,1000}\\CurrentControlSet\\Services\\ScreenConnect\s.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10#registryN/A1010N/AN/AN/AN/A14720
460*\CurrentControlSet\Services\SupremoService*.{0,1000}\\CurrentControlSet\\Services\\SupremoService.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#servicename #registryregistry1010N/AN/AN/AN/A14722
461*\CurrentControlSet\Services\TeamViewer*.{0,1000}\\CurrentControlSet\\Services\\TeamViewer.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10#servicename #registryFP risk - teamviewer usage1010N/AN/AN/AN/A14723
462*\CurrentControlSet\Services\VSAX*.{0,1000}\\CurrentControlSet\\Services\\VSAX.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#servicename #registryregistry1010N/AN/AN/AN/A14724
463*\CurrentControlSet\Services\Zoho Assist-Remote Support*.{0,1000}\\CurrentControlSet\\Services\\Zoho\sAssist\-Remote\sSupport.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10#servicename #registryN/A1010N/AN/AN/AN/A14725
464*\CurrentVersion\App Paths\RemotePCPerformance*.{0,1000}\\CurrentVersion\\App\sPaths\\RemotePCPerformance.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A14727
465*\CurrentVersion\Devices\Remote Utilities Printer*.{0,1000}\\CurrentVersion\\Devices\\Remote\sUtilities\sPrinter.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A14728
466*\CurrentVersion\Devices\RemotePC Printer*.{0,1000}\\CurrentVersion\\Devices\\RemotePC\sPrinter.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A14729
467*\CurrentVersion\Run\Bomgar Support Reconnect*.{0,1000}\\CurrentVersion\\Run\\Bomgar\sSupport\sReconnect.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14730
468*\CurrentVersion\Run\DWAgentMon*.{0,1000}\\CurrentVersion\\Run\\DWAgentMon.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z14731
469*\CurrentVersion\Run\Quasar Client Startup*.{0,1000}\\CurrentVersion\\Run\\Quasar\sClient\sStartup.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z14732
470*\currentversion\uninstall\dameware remote everywhere*.{0,1000}\\currentversion\\uninstall\\dameware\sremote\severywhere.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14734
471*\CurrentVersion\Uninstall\Representative Console [eval-*.{0,1000}\\CurrentVersion\\Uninstall\\Representative\sConsole\s\[eval\-.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A14739
472*\CurrentVersion\Uninstall\RustDesk*.{0,1000}\\CurrentVersion\\Uninstall\\RustDesk.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z14740
473*\CurrentVersion\Uninstall\Ultravnc2_is1\*.{0,1000}\\CurrentVersion\\Uninstall\\Ultravnc2_is1\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A14742
474*\DameWare Development\MrcVerbLog*.{0,1000}\\DameWare\sDevelopment\\MrcVerbLog.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14769
475*\Dameware Mini Remote Control x64\*.{0,1000}\\Dameware\sMini\sRemote\sControl\sx64\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14770
476*\dameware mini remote control x64\*.{0,1000}\\dameware\smini\sremote\scontrol\sx64\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14771
477*\DameWare Mini Remote Control*.exe*.{0,1000}\\DameWare\sMini\sRemote\sControl.{0,1000}\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A14772
478*\Dameware Mini Remote Control.lnk*.{0,1000}\\Dameware\sMini\sRemote\sControl\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14773
479*\dameware remote everywhere agent*.{0,1000}\\dameware\sremote\severywhere\sagent.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14774
480*\dameware remote everywhere.lnk*.{0,1000}\\dameware\sremote\severywhere\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14775
481*\Dameware Remote Support .lnk*.{0,1000}\\Dameware\sRemote\sSupport\s\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A14776
482*\Dameware Remote Support\*.{0,1000}\\Dameware\sRemote\sSupport\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A14777
483*\DameWare.Diagnostics*.{0,1000}\\DameWare\.Diagnostics.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14778
484*\DameWare.LogAdjuster.exe*.{0,1000}\\DameWare\.LogAdjuster\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14779
485*\DameWare.LogAdjuster.exe.config*.{0,1000}\\DameWare\.LogAdjuster\.exe\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14780
486*\damewareagent.exe.{0,1000}\\damewareagent\.exegreyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14781
487*\damewareagent.exe*.{0,1000}\\damewareagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14782
488*\damewareremoteeverywhere\*.{0,1000}\\damewareremoteeverywhere\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14783
489*\damewareremoteeverywhereagentinstaller.install.log*.{0,1000}\\damewareremoteeverywhereagentinstaller\.install\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14784
490*\dctoolshardware.exe*.{0,1000}\\dctoolshardware\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A14831
491*\disable dameware remote everywhere agent.lnk*.{0,1000}\\disable\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A14948
492*\DMRC-10-Evaluation.lic*.{0,1000}\\DMRC\-10\-Evaluation\.lic.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A14989
493*\DNTU.exe*.{0,1000}\\DNTU\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A15013
494*\Documents\ConnectWiseControl\Files*.{0,1000}\\Documents\\ConnectWiseControl\\Files.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A15017
495*\dre_mac_console.zip*.{0,1000}\\dre_mac_console\.zip.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A15065
496*\drivers\x64\rupdui.dll*.{0,1000}\\drivers\\x64\\rupdui\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A15073
497*\dwagent.exe*.{0,1000}\\dwagent\.exe.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15130
498*\DWAgent.lnk*.{0,1000}\\DWAgent\.lnk.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15131
499*\dwagent.log*.{0,1000}\\dwagent\.log.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15132
500*\dwagent.pid*.{0,1000}\\dwagent\.pid.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15133
501*\dwagent.start*.{0,1000}\\dwagent\.start.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15134
502*\dwagent.stop*.{0,1000}\\dwagent\.stop.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15135
503*\dwaggdi.dll*.{0,1000}\\dwaggdi\.dll.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15136
504*\dwaginstall.log*.{0,1000}\\dwaginstall\.log.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15137
505*\dwaglnc.exe*.{0,1000}\\dwaglnc\.exe.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15138
506*\dwagsvc.exe*.{0,1000}\\dwagsvc\.exe.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15139
507*\dwagupd.dll*.{0,1000}\\dwagupd\.dll.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z15140
508*\DWAMTD.dll*.{0,1000}\\DWAMTD\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15141
509*\DWAMTDRES.dll*.{0,1000}\\DWAMTDRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15142
510*\DWMRC_St_64.msi*.{0,1000}\\DWMRC_St_64\.msi.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15143
511*\DWMSISET.W32*.{0,1000}\\DWMSISET\.W32.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15144
512*\DWMSISET.X64*.{0,1000}\\DWMSISET\.X64.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15145
513*\DWNativeWCFClient.dll*.{0,1000}\\DWNativeWCFClient\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15146
514*\DWNativeWCFClientRES.dll*.{0,1000}\\DWNativeWCFClientRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15147
515*\DWPing.dll*.{0,1000}\\DWPing\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15148
516*\DWPINGRES.dll*.{0,1000}\\DWPINGRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15149
517*\DWRCBA.dll*.{0,1000}\\DWRCBA\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15150
518*\DWRCBN.dll*.{0,1000}\\DWRCBN\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15151
519*\DWRCC.chm*.{0,1000}\\DWRCC\.chm.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15152
520*\DWRCC.exe*.{0,1000}\\DWRCC\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15153
521*\DWRCC.log*.{0,1000}\\DWRCC\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15154
522*\DWRCC.log*.{0,1000}\\DWRCC\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A15155
523*\DWRCC.Logging.xml*.{0,1000}\\DWRCC\.Logging\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15156
524*\DWRCCH.dll*.{0,1000}\\DWRCCH\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15157
525*\DWRCChat.dll*.{0,1000}\\DWRCChat\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15158
526*\DWRCChatRES.dll*.{0,1000}\\DWRCChatRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15159
527*\DWRCCMD.exe*.{0,1000}\\DWRCCMD\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15160
528*\DWRCCRES.dll*.{0,1000}\\DWRCCRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15161
529*\DWRCCSFTv2.data*.{0,1000}\\DWRCCSFTv2\.data.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15162
530*\DWRCD.dll*.{0,1000}\\DWRCD\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15163
531*\DWRCD.dll*.{0,1000}\\DWRCD\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15164
532*\DWRCK.dll*.{0,1000}\\DWRCK\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15165
533*\DWRCOP.dll*.{0,1000}\\DWRCOP\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15166
534*\DWRCOPRES.dll*.{0,1000}\\DWRCOPRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15167
535*\DWRCPN.dll*.{0,1000}\\DWRCPN\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15168
536*\DWRCRSA.dll*.{0,1000}\\DWRCRSA\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15169
537*\DWRCRSS.dll*.{0,1000}\\DWRCRSS\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15170
538*\DWRCRSS.dll*.{0,1000}\\DWRCRSS\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15171
539*\DWRCS.exe*.{0,1000}\\DWRCS\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15172
540*\DWRCS.Logging.xml*.{0,1000}\\DWRCS\.Logging\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15173
541*\DWRCS.reg*.{0,1000}\\DWRCS\.reg.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A15174
542*\DWRCSET.dll*.{0,1000}\\DWRCSET\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15175
543*\DWRCSETRES.dll*.{0,1000}\\DWRCSETRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15176
544*\DWRCSh.dll*.{0,1000}\\DWRCSh\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15177
545*\DWRCSHRegister.cmd*.{0,1000}\\DWRCSHRegister\.cmd.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15178
546*\DWRCSI.dll*.{0,1000}\\DWRCSI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15179
547*\DWRCSI.dll*.{0,1000}\\DWRCSI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15180
548*\DWRCSIRES.dll*.{0,1000}\\DWRCSIRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15181
549*\DWRCSMSI.exe*.{0,1000}\\DWRCSMSI\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15182
550*\DWRCSMSIRES.dll*.{0,1000}\\DWRCSMSIRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15183
551*\DWRCSPC.exe*.{0,1000}\\DWRCSPC\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15184
552*\DWRCSPCRES.dll*.{0,1000}\\DWRCSPCRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15185
553*\DWRCSPX.exe*.{0,1000}\\DWRCSPX\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15186
554*\DWRCSPXRES.dll*.{0,1000}\\DWRCSPXRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15187
555*\DWRCSRES.dll*.{0,1000}\\DWRCSRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15188
556*\DWRCST.exe*.{0,1000}\\DWRCST\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15189
557*\DWRCST.Logging.xml*.{0,1000}\\DWRCST\.Logging\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15190
558*\DWRCSTRES.dll*.{0,1000}\\DWRCSTRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15191
559*\DWRCU3.dll*.{0,1000}\\DWRCU3\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15192
560*\DWRCWHD.Logging.xml*.{0,1000}\\DWRCWHD\.Logging\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15193
561*\DWRCWHDAPI.dll*.{0,1000}\\DWRCWHDAPI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15194
562*\DWRCWHDUI.dll*.{0,1000}\\DWRCWHDUI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15195
563*\DWRCWHDUIRES.dll*.{0,1000}\\DWRCWHDUIRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15196
564*\DWRCWol.dll*.{0,1000}\\DWRCWol\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15197
565*\DWRCWXL.dll*.{0,1000}\\DWRCWXL\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15198
566*\DWRTD.dll*.{0,1000}\\DWRTD\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15199
567*\DWRTDE.exe*.{0,1000}\\DWRTDE\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15200
568*\DWRTDR.dll*.{0,1000}\\DWRTDR\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15201
569*\DWRTDR.dll*.{0,1000}\\DWRTDR\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15202
570*\DWSGRWRP.dll*.{0,1000}\\DWSGRWRP\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15203
571*\DWUtil.dll*.{0,1000}\\DWUtil\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15204
572*\DWWFDS.dll*.{0,1000}\\DWWFDS\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A15205
573*\eHorus Agent Menu.lnk*.{0,1000}\\eHorus\sAgent\sMenu\.lnk.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15234
574*\eHorus Agent.lnk*.{0,1000}\\eHorus\sAgent\.lnk.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15235
575*\ehorus standalone.exe*.{0,1000}\\ehorus\sstandalone\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15236
576*\ehorus_agent.conf*.{0,1000}\\ehorus_agent\.conf.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15237
577*\ehorus_agent.exe*.{0,1000}\\ehorus_agent\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15238
578*\ehorus_agent.log*.{0,1000}\\ehorus_agent\.log.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#logfileN/A1010N/AN/AN/AN/A15239
579*\ehorus_agent_disconn.log*.{0,1000}\\ehorus_agent_disconn\.log.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#logfileN/A1010N/AN/AN/AN/A15240
580*\ehorus_cmd.exe*.{0,1000}\\ehorus_cmd\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15241
581*\ehorus_display.exe*.{0,1000}\\ehorus_display\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15242
582*\ehorus_installer_windows-*.{0,1000}\\ehorus_installer_windows\-.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15243
583*\ehorus_launcher.exe*.{0,1000}\\ehorus_launcher\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15244
584*\ehorus_uit.exe*.{0,1000}\\ehorus_uit\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15245
585*\eHorusMsiCustomActions.dll*.{0,1000}\\eHorusMsiCustomActions\.dll.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A15246
586*\embedhook-x64.exe*.{0,1000}\\embedhook\-x64\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A15264
587*\embedhook-x86.exe*.{0,1000}\\embedhook\-x86\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A15265
588*\enable dameware remote everywhere agent.lnk*.{0,1000}\\enable\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A15269
589*\eventlog\application\dameware *.{0,1000}\\eventlog\\application\\dameware\s.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A15326
590*\file_transfer_trace.txt*.{0,1000}\\file_transfer_trace\.txt.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://upadhyayraj.medium.com/beyond-connection-logs-understanding-file-transfer-artifacts-in-anydesk-forensics-b5812c817aad10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A15432
591*\g2comm.exe*.{0,1000}\\g2comm\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15520
592*\g2fileh.exe*.{0,1000}\\g2fileh\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15521
593*\g2host.exe*.{0,1000}\\g2host\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15522
594*\g2mainh.exe*.{0,1000}\\g2mainh\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15523
595*\g2printh.exe*.{0,1000}\\g2printh\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15524
596*\g2svc.exe*.{0,1000}\\g2svc\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15525
597*\getsupportservice_common_dameware*.{0,1000}\\getsupportservice_common_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A15608
598*\getsupportservice_dameware*.{0,1000}\\getsupportservice_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A15609
599*\getsupportservice_dameware\*.{0,1000}\\getsupportservice_dameware\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A15610
600*\goLoader.exe*.{0,1000}\\goLoader\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15671
601*\Google\Chrome Remote Desktop\*.{0,1000}\\Google\\Chrome\sRemote\sDesktop\\.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A15679
602*\gosetup[1].exe*.{0,1000}\\gosetup\[1\]\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15690
603*\GoTo Opener.exe*.{0,1000}\\GoTo\sOpener\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15695
604*\GoTo\Logs\goto.log*.{0,1000}\\GoTo\\Logs\\goto\.log.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15696
605*\gotomon.dll*.{0,1000}\\gotomon\.dll.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15697
606*\gotomon_x64.dll*.{0,1000}\\gotomon_x64\.dll.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15698
607*\GoToMyPC.cab*.{0,1000}\\GoToMyPC\.cab.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15699
608*\GoToMyPC\*\*\g2ldr.log*.{0,1000}\\GoToMyPC\\.{0,1000}\\.{0,1000}\\g2ldr\.log.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15700
609*\gotomypc\g2pre.exe*.{0,1000}\\gotomypc\\g2pre\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15701
610*\GoToMyPC\g2svc.exe*.{0,1000}\\GoToMyPC\\g2svc\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15702
611*\gotomypc_3944.exe*.{0,1000}\\gotomypc_3944\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15703
612*\GoToMyPCCrashHandler.exe*.{0,1000}\\GoToMyPCCrashHandler\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15704
613*\GoToOpener.log*.{0,1000}\\GoToOpener\.log.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15705
614*\GoToOpener[1].msi*.{0,1000}\\GoToOpener\[1\]\.msi.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15706
615*\HiddenDesktop.h*.{0,1000}\\HiddenDesktop\.h.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054451332025-03-27T21:20:10Z2021-09-03T17:34:44Z15787
616*\host-7.2.2.0.msi*.{0,1000}\\host\-7\.2\.2\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A15815
617*\hvnc.exe*.{0,1000}\\hvnc\.exe.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054451332025-03-27T21:20:10Z2021-09-03T17:34:44Z15848
618*\HVNC.sln*.{0,1000}\\HVNC\.sln.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054451332025-03-27T21:20:10Z2021-09-03T17:34:44Z15849
619*\HVNC.vcxproj*.{0,1000}\\HVNC\.vcxproj.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054451332025-03-27T21:20:10Z2021-09-03T17:34:44Z15850
620*\HVNC-main.zip*.{0,1000}\\HVNC\-main\.zip.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054451332025-03-27T21:20:10Z2021-09-03T17:34:44Z15851
621*\ICON_ID_GOTOMYPC*.{0,1000}\\ICON_ID_GOTOMYPC.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A15868
622*\InternetIdService.exe*.{0,1000}\\InternetIdService\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A15930
623*\InternetIdService_*-*-*.txt.{0,1000}\\InternetIdService_.{0,1000}\-.{0,1000}\-.{0,1000}\.txtgreyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A15931
624*\InventoryApplicationFile\aeroadmin*.{0,1000}\\InventoryApplicationFile\\aeroadmin.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A15956
625*\InventoryApplicationFile\rpcattendedadmin*.{0,1000}\\InventoryApplicationFile\\rpcattendedadmin.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A15958
626*\InventoryApplicationFile\screenconnect.cl*.{0,1000}\\InventoryApplicationFile\\screenconnect\.cl.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A15959
627*\InventoryApplicationFile\screenconnect.wi*.{0,1000}\\InventoryApplicationFile\\screenconnect\.wi.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A15960
628*\InventoryApplicationFile\tacticalagent-v2*.{0,1000}\\InventoryApplicationFile\\tacticalagent\-v2.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10#registryregistry101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z15961
629*\InventoryApplicationFile\ultravnc_*.{0,1000}\\InventoryApplicationFile\\ultravnc_.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A15962
630*\InventoryApplicationFile\zaservice.exe*.{0,1000}\\InventoryApplicationFile\\zaservice\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A15963
631*\ITarian Remote Access.lnk*.{0,1000}\\ITarian\sRemote\sAccess\.lnk.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A16013
632*\itarian\endpoint manager\itsmagent.exe*.{0,1000}\\itarian\\endpoint\smanager\\itsmagent\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A16014
633*\itarian\endpoint manager\itsmservice.exe*.{0,1000}\\itarian\\endpoint\smanager\\itsmservice\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A16015
634*\itarian\endpoint manager\rhost.exe*.{0,1000}\\itarian\\endpoint\smanager\\rhost\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A16016
635*\ITarian\RemoteControl*.{0,1000}\\ITarian\\RemoteControl.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A16017
636*\ITarian_Remote_Access_*.log*.{0,1000}\\ITarian_Remote_Access_.{0,1000}\.log.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A16018
637*\ITarianRemoteAccess.exe*.{0,1000}\\ITarianRemoteAccess\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A16019
638*\JWrapper-SimpleHelp Remote Work*.{0,1000}\\JWrapper\-SimpleHelp\sRemote\sWork.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A16052
639*\JWrapper-SimpleHelp Technician*.{0,1000}\\JWrapper\-SimpleHelp\sTechnician.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A16053
640*\JWrapper-SimpleHelp Technician\*.{0,1000}\\JWrapper\-SimpleHelp\sTechnician\\.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A16054
641*\Kaseya\PC Monitor\*.{0,1000}\\Kaseya\\PC\sMonitor\\.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A16063
642*\level.exe*--check-service*.{0,1000}\\level\.exe.{0,1000}\-\-check\-service.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A16231
643*\level-remote-control-ffmpeg.exe.download*.{0,1000}\\level\-remote\-control\-ffmpeg\.exe\.download.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A16232
644*\level-windows-amd64.exe*.{0,1000}\\level\-windows\-amd64\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A16233
645*\level-windows-arm64.exe*.{0,1000}\\level\-windows\-arm64\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A16234
646*\librustdesk.dll*.{0,1000}\\librustdesk\.dll.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z16238
647*\linuxconsole_dw (1).zip*.{0,1000}\\linuxconsole_dw\s\(1\)\.zip.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16253
648*\LMI_Rescue.exe*.{0,1000}\\LMI_Rescue\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16290
649*\lmi_rescue_srv.exe*.{0,1000}\\lmi_rescue_srv\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16291
650*\LMIGuardianEvt.dll*.{0,1000}\\LMIGuardianEvt\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16292
651*\LMIR*.tmp\rarcc.dll*.{0,1000}\\LMIR.{0,1000}\.tmp\\rarcc\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16293
652*\LMIRescue-*.clog*.{0,1000}\\LMIRescue\-.{0,1000}\.clog.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16294
653*\LMIRescue-*.connlog*.{0,1000}\\LMIRescue\-.{0,1000}\.connlog.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16295
654*\LMIRescueCOL.log*.{0,1000}\\LMIRescueCOL\.log.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16296
655*\LMIRescueMqttMessages_*.dat*.{0,1000}\\LMIRescueMqttMessages_.{0,1000}\.dat.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16297
656*\LMIRescueUpdater.log*.{0,1000}\\LMIRescueUpdater\.log.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16298
657*\LMIRhook.000.dll*.{0,1000}\\LMIRhook\.000\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16299
658*\lmirtechconsole.exe*.{0,1000}\\lmirtechconsole\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16300
659*\LMIRTechConsole.exe*.{0,1000}\\LMIRTechConsole\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16301
660*\LMITrs-*.trs*.{0,1000}\\LMITrs\-.{0,1000}\.trs.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16302
661*\Local\Temp\LogMeInLogs\GoToOpenerMsi\*.{0,1000}\\Local\\Temp\\LogMeInLogs\\GoToOpenerMsi\\.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A16322
662*\log\FileTransferWindowAppLog.log*.{0,1000}\\log\\FileTransferWindowAppLog\.log.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A16350
663*\LogMeIn Rescue Applet\LMIR*.{0,1000}\\LogMeIn\sRescue\sApplet\\LMIR.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16352
664*\LogMeIn Rescue Applet\LMIR*.{0,1000}\\LogMeIn\sRescue\sApplet\\LMIR.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16353
665*\LogMeIn Rescue AVI Codec\*.{0,1000}\\LogMeIn\sRescue\sAVI\sCodec\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16354
666*\logmein rescue technician console\*.{0,1000}\\logmein\srescue\stechnician\sconsole\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16355
667*\LogMeIn\Dumps\*.{0,1000}\\LogMeIn\\Dumps\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16356
668*\LogMeInLogs\GoToOpenerMsi*.{0,1000}\\LogMeInLogs\\GoToOpenerMsi.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A16357
669*\LogMeInRescue_ipc*.{0,1000}\\LogMeInRescue_ipc.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/Apipename1010N/AN/AN/AN/A16358
670*\LogMeInRescue_rarc_r_*.{0,1000}\\LogMeInRescue_rarc_r_.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/Apipename1010N/AN/AN/AN/A16359
671*\LogMeInRescue_rarc_w_*.{0,1000}\\LogMeInRescue_rarc_w_.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/Apipename1010N/AN/AN/AN/A16360
672*\LogMeInRescueTechnicianConsole_x64*.{0,1000}\\LogMeInRescueTechnicianConsole_x64.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A16361
673*\logs\baseclient_*.log*.{0,1000}\\logs\\baseclient_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16366
674*\logs\baseconsoleapp_*.log*.{0,1000}\\logs\\baseconsoleapp_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16367
675*\logs\basupclphlp_*.log*.{0,1000}\\logs\\basupclphlp_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16368
676*\Logs\DNTU.log*.{0,1000}\\Logs\\DNTU\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A16369
677*\logs\RCService.txt*.{0,1000}\\logs\\RCService\.txt.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A16370
678*\Logs\rut_log_*.html*.{0,1000}\\Logs\\rut_log_.{0,1000}\.html.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A16371
679*\meshagent.db*.{0,1000}\\meshagent\.db.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z16550
680*\MeshAgent.sln*.{0,1000}\\MeshAgent\.sln.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z16551
681*\MeshAgentKvm.log*.{0,1000}\\MeshAgentKvm\.log.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z16552
682*\MeshAgent-master*.{0,1000}\\MeshAgent\-master.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z16553
683*\meshcentral.db*.{0,1000}\\meshcentral\.db.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z16554
684*\meshcentral.js*.{0,1000}\\meshcentral\.js.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z16555
685*\MeshCentral.sln*.{0,1000}\\MeshCentral\.sln.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z16556
686*\MeshCentral\*.{0,1000}\\MeshCentral\\.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z16557
687*\MeshCmd.exe*.{0,1000}\\MeshCmd\.exe.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z16558
688*\meshcmd.js*.{0,1000}\\meshcmd\.js.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z16559
689*\meshcommander.dmp*.{0,1000}\\meshcommander\.dmp.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z16560
690*\MeshMessenger.exe*.{0,1000}\\MeshMessenger\.exe.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z16561
691*\MeshService.rc*.{0,1000}\\MeshService\.rc.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z16562
692*\Microsoft.RemoteAssistance.QuickAssist\*.{0,1000}\\Microsoft\.RemoteAssistance\.QuickAssist\\.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A16575
693*\microsoft.remoteassistance.quickassist\*.{0,1000}\\microsoft\.remoteassistance\.quickassist\\.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A16576
694*\Microsoft\Windows\Start Menu\Programs\eHorus Agent\*.{0,1000}\\Microsoft\\Windows\\Start\sMenu\\Programs\\eHorus\sAgent\\.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A16578
695*\Mini Remote Control Client Agent MSI Builder.lnk*.{0,1000}\\Mini\sRemote\sControl\sClient\sAgent\sMSI\sBuilder\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16621
696*\Mini Remote Control Diagnostics.lnk*.{0,1000}\\Mini\sRemote\sControl\sDiagnostics\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16622
697*\Mini Remote Control Help.lnk*.{0,1000}\\Mini\sRemote\sControl\sHelp\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16623
698*\Mini Remote Control Log Adjuster.lnk*.{0,1000}\\Mini\sRemote\sControl\sLog\sAdjuster\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16624
699*\Mini Remote Control Service*.{0,1000}\\Mini\sRemote\sControl\sService.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16625
700*\Mini Remote Control Service\Settings\SFT: Upload Folder*.{0,1000}\\Mini\sRemote\sControl\sService\\Settings\\SFT\:\sUpload\sFolder.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16626
701*\Mini Remote Control.lnk*.{0,1000}\\Mini\sRemote\sControl\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16627
702*\mlnhcpkomdeavomsjalt*.{0,1000}\\mlnhcpkomdeavomsjalt.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/Anamed pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L21010N/AN/AN/AN/A16643
703*\MMSOFT Design\PC Monitor*.{0,1000}\\MMSOFT\sDesign\\PC\sMonitor.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A16645
704*\MMSOFT Design\Pulseway\*.{0,1000}\\MMSOFT\sDesign\\Pulseway\\.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A16646
705*\MRC_12.0_Bootstrap_Install_Log.txt*.{0,1000}\\MRC_12\.0_Bootstrap_Install_Log\.txt.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16665
706*\MRCCv2.db*.{0,1000}\\MRCCv2\.db.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A16666
707*\mspacredentialprovider_*_dameware.dll*.{0,1000}\\mspacredentialprovider_.{0,1000}_dameware\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16692
708*\msparegedithelper_*.{0,1000}\\msparegedithelper_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16693
709*\mspxtshlpsrv_*.{0,1000}\\mspxtshlpsrv_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16694
710*\mspxwebcom.dll*.{0,1000}\\mspxwebcom\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16695
711*\multiplicar negocios\beanywhere support express*.{0,1000}\\multiplicar\snegocios\\beanywhere\ssupport\sexpress.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A16709
712*\MWDiagnosticCollector.exe*.{0,1000}\\MWDiagnosticCollector\.exe.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A16714
713*\MWDiagnosticCollectorResult_*.zip*.{0,1000}\\MWDiagnosticCollectorResult_.{0,1000}\.zip.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A16715
714*\NETSUP~1\PCIShellExt64.dll*.{0,1000}\\NETSUP\~1\\PCIShellExt64\.dll.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A16830
715*\NetSupport Ltd\Client32*.{0,1000}\\NetSupport\sLtd\\Client32.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A16831
716*\NetSupport Ltd\PCICTL*.{0,1000}\\NetSupport\sLtd\\PCICTL.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A16832
717*\netsupport manager\*.{0,1000}\\netsupport\smanager\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A16833
718*\NetSupport School Console*.{0,1000}\\NetSupport\sSchool\sConsole.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A16834
719*\NetSupport School\*.{0,1000}\\NetSupport\sSchool\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A16835
720*\NetSupport School\NetSupport*.{0,1000}\\NetSupport\sSchool\\NetSupport.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A16836
721*\node_modules\meshcentral*.{0,1000}\\node_modules\\meshcentral.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z16935
722*\novaPDF11OEM(x64).msi*.{0,1000}\\novaPDF11OEM\(x64\)\.msi.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A16963
723*\nspowershell.exe*.{0,1000}\\nspowershell\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A16977
724*\nssadmui.exe*.{0,1000}\\nssadmui\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A16978
725*\Open Source\MeshCentral\*.{0,1000}\\Open\sSource\\MeshCentral\\.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101048746402025-04-21T16:50:06Z2017-08-28T16:21:11Z17044
726*\options.vnc*.{0,1000}\\options\.vnc.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A17052
727*\PC Monitor\Addons*.{0,1000}\\PC\sMonitor\\Addons.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A17155
728*\pcicfgui_client.exe*.{0,1000}\\pcicfgui_client\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A17160
729*\pciconn.exe*.{0,1000}\\pciconn\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A17161
730*\PCICTL\ConfigList\Standard\UI\*.{0,1000}\\PCICTL\\ConfigList\\Standard\\UI\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A17162
731*\pcictlui.exe*.{0,1000}\\pcictlui\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A17163
732*\PCIDEPLY.exe*.{0,1000}\\PCIDEPLY\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A17164
733*\PCINSSCD.exe*.{0,1000}\\PCINSSCD\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A17165
734*\PCINSSUI.exe*.{0,1000}\\PCINSSUI\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A17166
735*\PCISCRUI.exe*.{0,1000}\\PCISCRUI\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A17167
736*\PCIShellExt64.dll*.{0,1000}\\PCIShellExt64\.dll.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A17168
737*\PCMonitorManager.exe*.{0,1000}\\PCMonitorManager\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17169
738*\PCMonitorSrv.exe*.{0,1000}\\PCMonitorSrv\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17170
739*\PCMonitorTypes.dll*.{0,1000}\\PCMonitorTypes\.dll.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17171
740*\pcmontask.exe*.{0,1000}\\pcmontask\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A17172
741*\pcmrdp-client.dll*.{0,1000}\\pcmrdp\-client\.dll.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17173
742*\pcmupdate.exe*.{0,1000}\\pcmupdate\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A17174
743*\pcmupdate.exe*.{0,1000}\\pcmupdate\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17175
744*\pcmupdate.exe.config*.{0,1000}\\pcmupdate\.exe\.config.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17176
745*\Pictures\AnyDesk*.{0,1000}\\Pictures\\AnyDesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A17257
746*\pipe\chrome_remote_desktop*.{0,1000}\\pipe\\chrome_remote_desktop.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10#namedpipeN/A1010N/AN/AN/AN/A17269
747*\Prefetch\ANYDESK.EXE*.{0,1000}\\Prefetch\\ANYDESK\.EXE.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A17428
748*\prefetch\baconsoleapp.exe*.{0,1000}\\prefetch\\baconsoleapp\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17429
749*\prefetch\baseclient.exe*.{0,1000}\\prefetch\\baseclient\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17430
750*\prefetch\basupclphlp.exe*.{0,1000}\\prefetch\\basupclphlp\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17431
751*\prefetch\basupregedithlpr.exe*.{0,1000}\\prefetch\\basupregedithlpr\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17432
752*\prefetch\basupsrvc.exe*.{0,1000}\\prefetch\\basupsrvc\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17433
753*\prefetch\basupsrvccnfg.exe*.{0,1000}\\prefetch\\basupsrvccnfg\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17434
754*\prefetch\basupsrvcupdater.exe*.{0,1000}\\prefetch\\basupsrvcupdater\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17435
755*\prefetch\basupsysinf.exe*.{0,1000}\\prefetch\\basupsysinf\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17436
756*\prefetch\basuptshelper.exe*.{0,1000}\\prefetch\\basuptshelper\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17437
757*\prefetch\damewareagent.exe*.{0,1000}\\prefetch\\damewareagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17438
758*\prefetch\damewareremoteeverywhereconso*.{0,1000}\\prefetch\\damewareremoteeverywhereconso.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17439
759*\Prefetch\QUASAR.EXE*.{0,1000}\\Prefetch\\QUASAR\.EXE.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z17440
760*\prefetch\tcrmtshellagent.exe*.{0,1000}\\prefetch\\tcrmtshellagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17441
761*\prefetch\tcrmtshellviewer.exe*.{0,1000}\\prefetch\\tcrmtshellviewer\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17442
762*\prefetch\tkcuploader.exe*.{0,1000}\\prefetch\\tkcuploader\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17443
763*\Print\Printers\RemotePC Printer\*.{0,1000}\\Print\\Printers\\RemotePC\sPrinter\\.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A17451
764*\Printers\Remote Utilities Printer\*.{0,1000}\\Printers\\Remote\sUtilities\sPrinter\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A17455
765*\progra~2\damewa~1\remoteshell\*.{0,1000}\\progra\~2\\damewa\~1\\remoteshell\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17490
766*\Program Files (x86)\Advanced Monitoring Agent\*.{0,1000}\\Program\sFiles\s\(x86\)\\Advanced\sMonitoring\sAgent\\.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A17493
767*\Program Files (x86)\Anyplace Control*.{0,1000}\\Program\sFiles\s\(x86\)\\Anyplace\sControl.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A17494
768*\Program Files (x86)\Atera Networks*.{0,1000}\\Program\sFiles\s\(x86\)\\Atera\sNetworks.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A17495
769*\Program Files (x86)\Barracuda RMM\*.{0,1000}\\Program\sFiles\s\(x86\)\\Barracuda\sRMM\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A17496
770*\program files (x86)\gotomypc\g2tray.exe*.{0,1000}\\program\sfiles\s\(x86\)\\gotomypc\\g2tray\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A17497
771*\Program Files (x86)\ITarian\Endpoint Manager\*.{0,1000}\\Program\sFiles\s\(x86\)\\ITarian\\Endpoint\sManager\\.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A17499
772*\Program Files (x86)\ITarian\RemoteControl\*.{0,1000}\\Program\sFiles\s\(x86\)\\ITarian\\RemoteControl\\.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A17500
773*\Program Files (x86)\Level Platforms\*.{0,1000}\\Program\sFiles\s\(x86\)\\Level\sPlatforms\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A17503
774*\Program Files (x86)\Level\*.{0,1000}\\Program\sFiles\s\(x86\)\\Level\\.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A17504
775*\Program Files (x86)\RemotePC\*.{0,1000}\\Program\sFiles\s\(x86\)\\RemotePC\\.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17505
776*\program files (x86)\remotepc\remotepcperformance\*.{0,1000}\\program\sfiles\s\(x86\)\\remotepc\\remotepcperformance\\.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17506
777*\Program Files (x86)\uvnc bvba\*.{0,1000}\\Program\sFiles\s\(x86\)\\uvnc\sbvba\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A17509
778*\Program Files\Advanced Monitoring Agent\*.{0,1000}\\Program\sFiles\\Advanced\sMonitoring\sAgent\\.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A17510
779*\Program Files\Atera Networks*.{0,1000}\\Program\sFiles\\Atera\sNetworks.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A17511
780*\Program Files\Aweray*.{0,1000}\\Program\sFiles\\Aweray.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A17513
781*\Program Files\Barracuda RMM\*.{0,1000}\\Program\sFiles\\Barracuda\sRMM\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A17515
782*\Program Files\ehorus_agent\*.{0,1000}\\Program\sFiles\\ehorus_agent\\.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A17518
783*\Program Files\Level Platforms\*.{0,1000}\\Program\sFiles\\Level\sPlatforms\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A17524
784*\Program Files\Level\level.db*.{0,1000}\\Program\sFiles\\Level\\level\.db.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A17525
785*\Program Files\Level\osqueryi.exe*.{0,1000}\\Program\sFiles\\Level\\osqueryi\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A17526
786*\Program Files\Level\winpty.dll*.{0,1000}\\Program\sFiles\\Level\\winpty\.dll.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A17527
787*\Program Files\Level\winpty-agent.exe*.{0,1000}\\Program\sFiles\\Level\\winpty\-agent\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A17528
788*\Program Files\SubDir\Client.exe*.{0,1000}\\Program\sFiles\\SubDir\\Client\.exe.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z17533
789*\Program Files\Supremo\*.{0,1000}\\Program\sFiles\\Supremo\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A17534
790*\Program Files\TacticalAgent\*.{0,1000}\\Program\sFiles\\TacticalAgent\\.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z17535
791*\Program Files\TeamViewer*.{0,1000}\\Program\sFiles\\TeamViewer.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A17537
792*\ProgramData\Aeroadmin\*.{0,1000}\\ProgramData\\Aeroadmin\\.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AC:\ProgramData\Aeroadmin\log.json1010N/AN/AN/AN/A17543
793*\ProgramData\AMMYY\*.{0,1000}\\ProgramData\\AMMYY\\.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A17544
794*\ProgramData\Anyplace Control *.{0,1000}\\ProgramData\\Anyplace\sControl\s.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A17546
795*\ProgramData\Barracuda MSP\*.{0,1000}\\ProgramData\\Barracuda\sMSP\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A17548
796*\programdata\bomgar-scc-*.{0,1000}\\programdata\\bomgar\-scc\-.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A17549
797*\ProgramData\LogMeIn\*.{0,1000}\\ProgramData\\LogMeIn\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A17551
798*\ProgramData\Remote Utilities*.{0,1000}\\ProgramData\\Remote\sUtilities.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A17554
799*\ProgramData\RemotePC*.{0,1000}\\ProgramData\\RemotePC.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17556
800*\ProgramData\RustDesk\*.{0,1000}\\ProgramData\\RustDesk\\.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z17557
801*\ProgramData\SupremoRemoteDesktop*.{0,1000}\\ProgramData\\SupremoRemoteDesktop.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A17559
802*\ProgramData\TacticalRMM\*.{0,1000}\\ProgramData\\TacticalRMM\\.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z17560
803*\ProgramFile*\previous-version.{0,1000}\\ProgramFile.{0,40}\\previous-versiongreyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Aold anydesk version after update1010N/AN/AN/AN/A17561
804*\Programs\GoToMyPC.lnk*.{0,1000}\\Programs\\GoToMyPC\.lnk.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A17563
805*\Programs\SimpleHelp Remote Work"*.{0,1000}\\Programs\\SimpleHelp\sRemote\sWork\".{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A17564
806*\Programs\SimpleHelp Technician*.{0,1000}\\Programs\\SimpleHelp\sTechnician.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A17565
807*\Programs\TightVNC*.{0,1000}\\Programs\\TightVNC.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/AN/A1010N/AN/AN/AN/A17567
808*\Pulseway Remote Control\*.{0,1000}\\Pulseway\sRemote\sControl\\.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17644
809*\Pulseway\*.{0,1000}\\Pulseway\\.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17645
810*\pulseway_x64.deb*.{0,1000}\\pulseway_x64\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17646
811*\Pulseway_x64.msi*.{0,1000}\\Pulseway_x64\.msi.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17647
812*\pulseway_x86.deb*.{0,1000}\\pulseway_x86\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17648
813*\PulsewayServiceCheck*.{0,1000}\\PulsewayServiceCheck.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A17649
814*\pwyrc-agent.dll*.{0,1000}\\pwyrc\-agent\.dll.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17675
815*\pwy-rd\shell\open\command*.{0,1000}\\pwy\-rd\\shell\\open\\command.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A17676
816*\Quasar.Client\*.{0,1000}\\Quasar\.Client\\.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z17702
817*\Quasar.Common\*.cs*.{0,1000}\\Quasar\.Common\\.{0,1000}\.cs.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z17703
818*\quasar.p12*.{0,1000}\\quasar\.p12.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z17706
819*\Quasar.v*.zip*.{0,1000}\\Quasar\.v.{0,1000}\.zip.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z17707
820*\Quasar-master*.{0,1000}\\Quasar\-master.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z17708
821*\Quick Assist Installer.exe*.{0,1000}\\Quick\sAssist\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A17710
822*\quick launch\dameware remote everywhere tech console.lnk*.{0,1000}\\quick\slaunch\\dameware\sremote\severywhere\stech\sconsole\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A17711
823*\QuickAssist.exe*.{0,1000}\\QuickAssist\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A17712
824*\QuickAssist.pdb*.{0,1000}\\QuickAssist\.pdb.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A17713
825*\ractrlkeyhook.dll*.{0,1000}\\ractrlkeyhook\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A17726
826*\Radmin.exe*.{0,1000}\\Radmin\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A17727
827*\RADMIN.EXE-*.pf*.{0,1000}\\RADMIN\.EXE\-.{0,1000}\.pf.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A17728
828*\Radmin\radmin.rpb*.{0,1000}\\Radmin\\radmin\.rpb.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A17729
829*\Radmin_Server_*.msi*.{0,1000}\\Radmin_Server_.{0,1000}\.msi.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A17730
830*\Radmin_Viewer_*.msi*.{0,1000}\\Radmin_Viewer_.{0,1000}\.msi.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A17731
831*\Radmin_VPN_1.*.exe*.{0,1000}\\Radmin_VPN_1\..{0,1000}\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A17732
832*\remote access session.exe*.{0,1000}\\remote\saccess\ssession\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A17911
833*\remote access.exe*.{0,1000}\\remote\saccess\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A17912
834*\Remote AccessEmbedExample.html*.{0,1000}\\Remote\sAccessEmbedExample\.html.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A17913
835*\Remote Access-java-online.jar*.{0,1000}\\Remote\sAccess\-java\-online\.jar.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A17914
836*\remote support.exe*.{0,1000}\\remote\ssupport\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A17916
837*\Remote SupportEmbedExample.html*.{0,1000}\\Remote\sSupportEmbedExample\.html.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A17917
838*\remote utilities - host\*.{0,1000}\\remote\sutilities\s\-\shost\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A17918
839*\Remote Utilities - Host\*.{0,1000}\\Remote\sUtilities\s\-\sHost\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A17919
840*\remote utilities agent\*.{0,1000}\\remote\sutilities\sagent\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A17920
841*\Remote Utilities Agent\Logs*.{0,1000}\\Remote\sUtilities\sAgent\\Logs.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A17921
842*\Remote Utilities Files\rdp_connections\*.{0,1000}\\Remote\sUtilities\sFiles\\rdp_connections\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A17922
843*\Remote Utilities Server\*.{0,1000}\\Remote\sUtilities\sServer\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A17923
844*\Remote Utilities\Logs*.{0,1000}\\Remote\sUtilities\\Logs.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A17924
845*\Remote Utilities\MiniInternetId*.{0,1000}\\Remote\sUtilities\\MiniInternetId.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A17925
846*\remote_assistance_host.exe*.{0,1000}\\remote_assistance_host\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A17927
847*\Remote_Control_by_ITarian_*.log*.{0,1000}\\Remote_Control_by_ITarian_.{0,1000}\.log.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A17928
848*\remoteaccess-jar-with-dependencies.jar*.{0,1000}\\remoteaccess\-jar\-with\-dependencies\.jar.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A17929
849*\remotecontrol\rcontrol.exe*.{0,1000}\\remotecontrol\\rcontrol\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A17932
850*\remotecontrol\rviewer.exe*.{0,1000}\\remotecontrol\\rviewer\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A17933
851*\RemoteControlbyITarian (3).exe*.{0,1000}\\RemoteControlbyITarian\s\(3\)\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A17934
852*\RemoteControlbyITarian_(3).exe*.{0,1000}\\RemoteControlbyITarian_\(3\)\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A17935
853*\RemoteControlSetup.exe*.{0,1000}\\RemoteControlSetup\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A17936
854*\RemoteDesktop.exe*.{0,1000}\\RemoteDesktop\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A17937
855*\RemoteDesktop_x64.msi*.{0,1000}\\RemoteDesktop_x64\.msi.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A17939
856*\RemotePC (1).exe*.{0,1000}\\RemotePC\s\(1\)\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17952
857*\RemotePC Attended.lnk*.{0,1000}\\RemotePC\sAttended\.lnk.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17953
858*\RemotePC Attended\*.{0,1000}\\RemotePC\sAttended\\.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17954
859*\RemotePC Performance Host\*.{0,1000}\\RemotePC\sPerformance\sHost\\.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17955
860*\RemotePC.Common.dll*.{0,1000}\\RemotePC\.Common\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17956
861*\RemotePC.exe*.{0,1000}\\RemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17957
862*\RemotePC.exe*.{0,1000}\\RemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17958
863*\RemotePC.lnk*.{0,1000}\\RemotePC\.lnk.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17959
864*\RemotePC.tmp*.{0,1000}\\RemotePC\.tmp.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17960
865*\RemotePC.tmp*.{0,1000}\\RemotePC\.tmp.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17961
866*\RemotePC\*.dll*.{0,1000}\\RemotePC\\.{0,1000}\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17962
867*\RemotePCAttended.dmg*.{0,1000}\\RemotePCAttended\.dmg.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10#macosN/A1010N/AN/AN/AN/A17963
868*\RemotePCCopyPaste.txt*.{0,1000}\\RemotePCCopyPaste\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17964
869*\RemotePCDDriver.cat*.{0,1000}\\RemotePCDDriver\.cat.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17965
870*\RemotePCDDriver.inf*.{0,1000}\\RemotePCDDriver\.inf.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17966
871*\RemotePCDDriverumode1_0.dll*.{0,1000}\\RemotePCDDriverumode1_0\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17967
872*\RemotePCDDriverumode1_2.dll*.{0,1000}\\RemotePCDDriverumode1_2\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17968
873*\RemotePCDesktop.txt*.{0,1000}\\RemotePCDesktop\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17969
874*\RemotePCDnD.dll*.{0,1000}\\RemotePCDnD\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17970
875*\RemotePCDnDLauncher.exe*.{0,1000}\\RemotePCDnDLauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17971
876*\RemotePCHDDesktop.txt*.{0,1000}\\RemotePCHDDesktop\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17972
877*\RemotePCHDService.txt*.{0,1000}\\RemotePCHDService\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17973
878*\remotepclauncher.exe*.{0,1000}\\remotepclauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17974
879*\RemotePCModules.log*.{0,1000}\\RemotePCModules\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17975
880*\RemotePCPDF.conf*.{0,1000}\\RemotePCPDF\.conf.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17976
881*\RemotePCPerformancePlugins.exe*.{0,1000}\\RemotePCPerformancePlugins\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17977
882*\RemotePCPrinter.exe*.{0,1000}\\RemotePCPrinter\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17978
883*\RemotePCPrinter.exe.config*.{0,1000}\\RemotePCPrinter\.exe\.config.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17979
884*\RemotePCPrinter.pdb*.{0,1000}\\RemotePCPrinter\.pdb.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17980
885*\RemotePCPrinterCore.dll*.{0,1000}\\RemotePCPrinterCore\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17981
886*\RemotePCPrinterCore.pdb*.{0,1000}\\RemotePCPrinterCore\.pdb.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17982
887*\RemotePCProxys.dat*.{0,1000}\\RemotePCProxys\.dat.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17983
888*\RemotePCPS5UI.DLL*.{0,1000}\\RemotePCPS5UI\.DLL.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17984
889*\RemotePCPS5UI.DLL*.{0,1000}\\RemotePCPS5UI\.DLL.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17985
890*\RemotePCPSCRIPT.*.{0,1000}\\RemotePCPSCRIPT\..{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A17986
891*\RemotePCPSCRIPT.HLP*.{0,1000}\\RemotePCPSCRIPT\.HLP.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17987
892*\RemotePCPSCRIPT.NTF*.{0,1000}\\RemotePCPSCRIPT\.NTF.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17988
893*\RemotePCPSCRIPT5.DLL*.{0,1000}\\RemotePCPSCRIPT5\.DLL.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17989
894*\RemotePCService.exe*.{0,1000}\\RemotePCService\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17990
895*\RemotePCService.txt*.{0,1000}\\RemotePCService\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17991
896*\RemotePCService_2.txt*.{0,1000}\\RemotePCService_2\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17992
897*\RemotePCSuite.dmg*.{0,1000}\\RemotePCSuite\.dmg.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10#macosN/A1010N/AN/AN/AN/A17993
898*\RemotePCUDE.cat*.{0,1000}\\RemotePCUDE\.cat.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17994
899*\RemotePCUDE.inf*.{0,1000}\\RemotePCUDE\.inf.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17995
900*\RemotePCUDE.sys*.{0,1000}\\RemotePCUDE\.sys.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17996
901*\RemotePCUDEHost.cat*.{0,1000}\\RemotePCUDEHost\.cat.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17997
902*\RemotePCUDEHost.inf*.{0,1000}\\RemotePCUDEHost\.inf.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17998
903*\RemotePCUDEHost.sys*.{0,1000}\\RemotePCUDEHost\.sys.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A17999
904*\RemotePCUIA.exe*.{0,1000}\\RemotePCUIA\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18000
905*\RemotePCUIU.exe*.{0,1000}\\RemotePCUIU\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18001
906*\remotepcuiu.exe*.{0,1000}\\remotepcuiu\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18002
907*\RemotePCViewer.msi*.{0,1000}\\RemotePCViewer\.msi.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18003
908*\RemoteSupport\127.0.0.1.tvc*.{0,1000}\\RemoteSupport\\127\.0\.0\.1\.tvc.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A18011
909*\remoting_desktop.exe*.{0,1000}\\remoting_desktop\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A18012
910*\remoting_host.exe*.{0,1000}\\remoting_host\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A18013
911*\remoting_native_messaging_host.exe*.{0,1000}\\remoting_native_messaging_host\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A18014
912*\remoting_start_host.exe*.{0,1000}\\remoting_start_host\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A18015
913*\RescueWinRTLib.dll*.{0,1000}\\RescueWinRTLib\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A18022
914*\RescueWinRTLib.dll*.{0,1000}\\RescueWinRTLib\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A18023
915*\rfusclient.exe*.{0,1000}\\rfusclient\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A18064
916*\rmm-client-site-server.exe*.{0,1000}\\rmm\-client\-site\-server\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z18074
917*\rmm-client-site-server.exe*.{0,1000}\\rmm\-client\-site\-server\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z18075
918*\rmm-installer.ps1*.{0,1000}\\rmm\-installer\.ps1.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z18076
919*\RmmService.exe*.{0,1000}\\RmmService\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A18077
920*\Root\InventoryApplicationFile\support-logmeinr*.{0,1000}\\Root\\InventoryApplicationFile\\support\-logmeinr.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A18097
921*\Root\InventoryApplicationFile\za_connect.exe*.{0,1000}\\Root\\InventoryApplicationFile\\za_connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A18099
922*\RpcAccessPermissionNotifier.exe*.{0,1000}\\RpcAccessPermissionNotifier\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18115
923*\RpcApp\RPCCodecEngine.exe*.{0,1000}\\RpcApp\\RPCCodecEngine\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18116
924*\RpcApp\Tools\Chat.exe*.{0,1000}\\RpcApp\\Tools\\Chat\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18117
925*\RpcApp\Tools\TransferServer.exe*.{0,1000}\\RpcApp\\Tools\\TransferServer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18118
926*\RPCAppLauncherLogFile.txt*.{0,1000}\\RPCAppLauncherLogFile\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18119
927*\RPCAttended.log*.{0,1000}\\RPCAttended\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18120
928*\RPCAttendedAdmin.exe*.{0,1000}\\RPCAttendedAdmin\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18121
929*\RPCCertificate.log*.{0,1000}\\RPCCertificate\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18126
930*\RPCClipboard.exe*.{0,1000}\\RPCClipboard\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18127
931*\RPCClipboardAttended.exe*.{0,1000}\\RPCClipboardAttended\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18128
932*\RPCConfig.ini*.{0,1000}\\RPCConfig\.ini.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18129
933*\RPCCoreViewer.exe*.{0,1000}\\RPCCoreViewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18130
934*\RpcDND_Console.exe*.{0,1000}\\RpcDND_Console\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18131
935*\RPCDownloader.exe*.{0,1000}\\RPCDownloader\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18132
936*\RPCDownloaderLogFile.txt*.{0,1000}\\RPCDownloaderLogFile\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18133
937*\RPCDragDrop.txt*.{0,1000}\\RPCDragDrop\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18134
938*\RPCFirewallAttended.exe*.{0,1000}\\RPCFirewallAttended\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18138
939*\RPCFireWallRule.exe*.{0,1000}\\RPCFireWallRule\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18139
940*\RPCFireWallRulelogfile.txt*.{0,1000}\\RPCFireWallRulelogfile\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18140
941*\RPCKeyMouseHandler.txt*.{0,1000}\\RPCKeyMouseHandler\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18141
942*\RPCOTABootstrapper.exe*.{0,1000}\\RPCOTABootstrapper\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18143
943*\RPCOTADesktop.exe*.{0,1000}\\RPCOTADesktop\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18144
944*\RPCOTADesktopUAC.exe*.{0,1000}\\RPCOTADesktopUAC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18145
945*\RpcOTADND_Console.exe*.{0,1000}\\RpcOTADND_Console\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18146
946*\RPCOTAElevator.exe*.{0,1000}\\RPCOTAElevator\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18147
947*\RPCOTAFTHost.exe*.{0,1000}\\RPCOTAFTHost\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18148
948*\RPCOTAKillService.exe*.{0,1000}\\RPCOTAKillService\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18149
949*\RPCOTARelauncher.exe*.{0,1000}\\RPCOTARelauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18150
950*\RPCOTAService.exe*.{0,1000}\\RPCOTAService\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18151
951*\RPCOTAServiceUAC.exe*.{0,1000}\\RPCOTAServiceUAC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18152
952*\RPCOTAUtilityHost.exe*.{0,1000}\\RPCOTAUtilityHost\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18153
953*\RPCOTAViewerHostKeyPopup.exe*.{0,1000}\\RPCOTAViewerHostKeyPopup\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18154
954*\RPCPerformanceService.exe*.{0,1000}\\RPCPerformanceService\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18155
955*\RPCPerformanceService.log*.{0,1000}\\RPCPerformanceService\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18156
956*\RPCPerfViewer.exe*.{0,1000}\\RPCPerfViewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18157
957*\rpcperfviewer.exe*.{0,1000}\\rpcperfviewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18158
958*\RPCPerfViewer.log*.{0,1000}\\RPCPerfViewer\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18159
959*\RPCPing.txt*.{0,1000}\\RPCPing\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18160
960*\RPCPreUninstall.log*.{0,1000}\\RPCPreUninstall\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18161
961*\RPCPreUninstall.log*.{0,1000}\\RPCPreUninstall\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18162
962*\RPCPrinterDownloader.exe*.{0,1000}\\RPCPrinterDownloader\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18163
963*\RPCPrinterDownloader.txt*.{0,1000}\\RPCPrinterDownloader\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18164
964*\RPCProxyLatency.exe*.{0,1000}\\RPCProxyLatency\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18165
965*\RPCProxyLatencyAttended.exe*.{0,1000}\\RPCProxyLatencyAttended\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18166
966*\RPCSettings.ini*.{0,1000}\\RPCSettings\.ini.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18168
967*\RpcStickyNotes.exe*.{0,1000}\\RpcStickyNotes\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18169
968*\RPCSuite_*_Inc.log*.{0,1000}\\RPCSuite_.{0,1000}_Inc\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A18170
969*\RPCsuiteLaunch.txt*.{0,1000}\\RPCsuiteLaunch\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18171
970*\rserver3.exe*.{0,1000}\\rserver3\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A18175
971*\rsetup64.exe*/stop*.{0,1000}\\rsetup64\.exe.{0,1000}\/stop.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A18176
972*\rsl.exe /setup*.{0,1000}\\rsl\.exe\s\/setup.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A18177
973*\rsl.exe*/stop*.{0,1000}\\rsl\.exe.{0,1000}\/stop.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A18178
974*\RSTemp\ZohoMeeting\*.{0,1000}\\RSTemp\\ZohoMeeting\\.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A18183
975*\RunOnce\*LogMeInRescue_*.{0,1000}\\RunOnce\\.{0,1000}LogMeInRescue_.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A18221
976*\rustdesk-*-x86_64.exe*.{0,1000}\\rustdesk\-.{0,1000}\-x86_64\.exe.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z18228
977*\RustDesk.exe*.{0,1000}\\RustDesk\.exe.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z18229
978*\RustDesk.lnk*.{0,1000}\\RustDesk\.lnk.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z18230
979*\RustDesk\query*.{0,1000}\\RustDesk\\query.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/Anamed pipe101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z18231
980*\RustDeskIddDriver\*.{0,1000}\\RustDeskIddDriver\\.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z18232
981*\rutserv.exe*.{0,1000}\\rutserv\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A18240
982*\rutview.exe*.{0,1000}\\rutview\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A18241
983*\ru-viewer-portable\*.{0,1000}\\ru\-viewer\-portable\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A18242
984*\Safeboot\Network\AltMeshAgent*.{0,1000}\\Safeboot\\Network\\AltMeshAgent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z18251
985*\SafeBoot\Network\ShTemporaryService*.{0,1000}\\SafeBoot\\Network\\ShTemporaryService.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A18252
986*\SafeBoot\Network\SimpleHelp Server*.{0,1000}\\SafeBoot\\Network\\SimpleHelp\sServer.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A18253
987*\SafeBoot\Network\Zoho Assist-Remote Support*.{0,1000}\\SafeBoot\\Network\\Zoho\sAssist\-Remote\sSupport.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A18254
988*\Schedule\TaskCache\Tree\RemotePC*.{0,1000}\\Schedule\\TaskCache\\Tree\\RemotePC.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A18289
989*\ScreenConnect Client (*.{0,1000}\\ScreenConnect\sClient\s\(.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A18301
990*\ScreenConnect.Client.exe*.{0,1000}\\ScreenConnect\.Client\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMscreenconnect.com10N/AN/A1010N/AN/AN/AN/A18302
991*\ScreenConnect.ClientService.exe*.{0,1000}\\ScreenConnect\.ClientService\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/10N/AN/A1010N/AN/AN/AN/A18303
992*\ScreenConnect.ClientSetup.exe*.{0,1000}\\ScreenConnect\.ClientSetup\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/10N/AN/A1010N/AN/AN/AN/A18304
993*\ScreenConnect.Core.dll*.{0,1000}\\ScreenConnect\.Core\.dll.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A18305
994*\ScreenConnect.InstallerActions.dll*.{0,1000}\\ScreenConnect\.InstallerActions\.dll.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A18306
995*\ScreenConnect.Windows.dll*.{0,1000}\\ScreenConnect\.Windows\.dll.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A18307
996*\ScreenConnect.WindowsBackstageShell.exe*.{0,1000}\\ScreenConnect\.WindowsBackstageShell\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/10N/AN/A1010N/AN/AN/AN/A18308
997*\ScreenConnect.WindowsClient.exe*.{0,1000}\\ScreenConnect\.WindowsClient\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/10N/AN/A1010N/AN/AN/AN/A18309
998*\ScreenConnect\Bin\*.{0,1000}\\ScreenConnect\\Bin\\.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A18310
999*\Scripts\CreateRegKey.scp*.{0,1000}\\Scripts\\CreateRegKey\.scp.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A18314
1000*\Scripts\DirLst.log*.{0,1000}\\Scripts\\DirLst\.log.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A18315
1001*\Scripts\DirLst.scp*.{0,1000}\\Scripts\\DirLst\.scp.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A18316
1002*\Scripts\DrvSize.scp*.{0,1000}\\Scripts\\DrvSize\.scp.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A18317
1003*\Scripts\writetofile.scp*.{0,1000}\\Scripts\\writetofile\.scp.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A18318
1004*\Service Install Overwrite Remote CFG*.{0,1000}\\Service\sInstall\sOverwrite\sRemote\sCFG.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18363
1005*\Services\AteraAgent*.{0,1000}\\Services\\AteraAgent.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A18365
1006*\Services\DWAgent*.{0,1000}\\Services\\DWAgent.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z18366
1007*\Services\EventLog\Application\UltraVNC\*.{0,1000}\\Services\\EventLog\\Application\\UltraVNC\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A18367
1008*\Services\EventLog\Application\VSA X*.{0,1000}\\Services\\EventLog\\Application\\VSA\sX.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A18368
1009*\Services\EventLog\Application\VSAX*.{0,1000}\\Services\\EventLog\\Application\\VSAX.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A18369
1010*\Services\RemotePCAttendedService*.{0,1000}\\Services\\RemotePCAttendedService.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A18372
1011*\Services\SimpleHelp Server*.{0,1000}\\Services\\SimpleHelp\sServer.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A18373
1012*\Services\TeamViewer\*.{0,1000}\\Services\\TeamViewer\\.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10#registryFP risk - teamviewer usage1010N/AN/AN/AN/A18374
1013*\SFT: Enable Simple File Transfer*.{0,1000}\\SFT\:\sEnable\sSimple\sFile\sTransfer.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18392
1014*\simplegateway.service"*.{0,1000}\\simplegateway\.service\".{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A18834
1015*\SimpleHelp TechnicianEmbedExample.html*.{0,1000}\\SimpleHelp\sTechnicianEmbedExample\.html.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A18835
1016*\SimpleHelp.RemoteWork.127_0_0_1*.{0,1000}\\SimpleHelp\.RemoteWork\.127_0_0_1.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A18836
1017*\SimpleHelp.Technician.127_0_0_1*.{0,1000}\\SimpleHelp\.Technician\.127_0_0_1.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A18837
1018*\simplehelper64.exe*.{0,1000}\\simplehelper64\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A18838
1019*\simplehelp-rw\shell*.{0,1000}\\simplehelp\-rw\\shell.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A18839
1020*\simplehelpuninstall.exe*.{0,1000}\\simplehelpuninstall\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A18840
1021*\SimpleService.exe*.{0,1000}\\SimpleService\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A18843
1022*\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\*.{0,1000}\\slave\\workspace\\GIT_WIN_SRS_Formal\\Source\\irisserver\\.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7210N/AN/A1010N/AN/AN/AN/A18863
1023*\SOFTWARE\Ammyy\Admin*.{0,1000}\\SOFTWARE\\Ammyy\\Admin.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10#registryN/A1010N/AN/AN/AN/A18949
1024*\Software\AweSun\SunLogin\SunloginClient*.{0,1000}\\Software\\AweSun\\SunLogin\\SunloginClient.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10#registryN/A1010N/AN/AN/AN/A18950
1025*\SOFTWARE\Clients\Media\AnyDesk*.{0,1000}\\SOFTWARE\\Clients\\Media\\AnyDesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#registryrisk of false positives - compliance detection1010N/AN/AN/AN/A18953
1026*\SOFTWARE\eHorusDispl\*.{0,1000}\\SOFTWARE\\eHorusDispl\\.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#registryN/A1010N/AN/AN/AN/A18954
1027*\SOFTWARE\ITarian\RemoteControl*.{0,1000}\\SOFTWARE\\ITarian\\RemoteControl.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#registryN/A1010N/AN/AN/AN/A18955
1028*\SOFTWARE\Kaseya\*.{0,1000}\\SOFTWARE\\Kaseya\\.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A18956
1029*\SOFTWARE\Level Platforms\Managed Workplace\*.{0,1000}\\SOFTWARE\\Level\sPlatforms\\Managed\sWorkplace\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10#registryN/A1010N/AN/AN/AN/A18958
1030*\Software\LogMeInRescue\*.{0,1000}\\Software\\LogMeInRescue\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10#registryN/A1010N/AN/AN/AN/A18959
1031*\SOFTWARE\Microsoft\Tracing\PCMonitorSrv_RAS*.{0,1000}\\SOFTWARE\\Microsoft\\Tracing\\PCMonitorSrv_RAS.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A18961
1032*\SOFTWARE\Microsoft\Tracing\Quick Assist Installer*.{0,1000}\\SOFTWARE\\Microsoft\\Tracing\\Quick\sAssist\sInstaller.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510#registryQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A18962
1033*\Software\NetSupport Ltd\*.{0,1000}\\Software\\NetSupport\sLtd\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A18966
1034*\SOFTWARE\ORL\VNCHooks\Application_Prefs\WinVNC*.{0,1000}\\SOFTWARE\\ORL\\VNCHooks\\Application_Prefs\\WinVNC.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A18968
1035*\SOFTWARE\Supremo\*.{0,1000}\\SOFTWARE\\Supremo\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#registryregistry1010N/AN/AN/AN/A18972
1036*\Software\Supremo\Printer\*.{0,1000}\\Software\\Supremo\\Printer\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#registryregistry1010N/AN/AN/AN/A18973
1037*\Software\TeamViewer\Temp*.{0,1000}\\Software\\TeamViewer\\Temp.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10#registryFP risk - teamviewer usage1010N/AN/AN/AN/A18979
1038*\SOFTWARE\Usoris\Remote Utilities\*.{0,1000}\\SOFTWARE\\Usoris\\Remote\sUtilities\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A18980
1039*\SOFTWARE\WOW6432Node\ITarian\ITSM\*.{0,1000}\\SOFTWARE\\WOW6432Node\\ITarian\\ITSM\\.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#registryN/A1010N/AN/AN/AN/A18982
1040*\SOFTWARE\WOW6432Node\Supremo\*.{0,1000}\\SOFTWARE\\WOW6432Node\\Supremo\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#registryregistry1010N/AN/AN/AN/A18985
1041*\SOFTWARE\WOW6432Node\TightVNC\*.{0,1000}\\SOFTWARE\\WOW6432Node\\TightVNC\\.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10#registryregistry1010N/AN/AN/AN/A18986
1042*\SOFTWARE\Zoho Assist*.{0,1000}\\SOFTWARE\\Zoho\sAssist.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10#registryN/A1010N/AN/AN/AN/A18988
1043*\SolarWinds.DepInjectedClassWalker.dll*.{0,1000}\\SolarWinds\.DepInjectedClassWalker\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18990
1044*\SolarWinds.Diags.Contract.dll*.{0,1000}\\SolarWinds\.Diags\.Contract\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18991
1045*\SolarWinds.Diags.DameWare.Extensions.dll*.{0,1000}\\SolarWinds\.Diags\.DameWare\.Extensions\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18992
1046*\SolarWinds.Diags.exe*.{0,1000}\\SolarWinds\.Diags\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18993
1047*\SolarWinds.Diags.exe.config*.{0,1000}\\SolarWinds\.Diags\.exe\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18994
1048*\SolarWinds.Diags.Extensions.Common.dll*.{0,1000}\\SolarWinds\.Diags\.Extensions\.Common\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18995
1049*\SolarWinds.Diags.Extensions.dll*.{0,1000}\\SolarWinds\.Diags\.Extensions\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18996
1050*\SolarWinds.Diags.Platform.Extensions.dll*.{0,1000}\\SolarWinds\.Diags\.Platform\.Extensions\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18997
1051*\SolarWinds.Diags.Strings.dll*.{0,1000}\\SolarWinds\.Diags\.Strings\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A18998
1052*\SOLARWINDS.DRS.LICENSOR.EXE-*.{0,1000}\\SOLARWINDS\.DRS\.LICENSOR\.EXE\-.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A18999
1053*\SolarWinds.LicenseManager.msi*.{0,1000}\\SolarWinds\.LicenseManager\.msi.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19000
1054*\SolarWinds.Licensing.Gen4.dll*.{0,1000}\\SolarWinds\.Licensing\.Gen4\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19001
1055*\SolarWinds.Licensing.Gen4.dll.config*.{0,1000}\\SolarWinds\.Licensing\.Gen4\.dll\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19002
1056*\SolarWinds.Licensing.Gen4.Resources.dll*.{0,1000}\\SolarWinds\.Licensing\.Gen4\.Resources\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19003
1057*\SolarWinds.Licensing.Gen4.UI.dll*.{0,1000}\\SolarWinds\.Licensing\.Gen4\.UI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19004
1058*\SolarWinds.Licensing.MRC.COMWrapper.dll*.{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19005
1059*\SolarWinds.Licensing.MRC.COMWrapper.dll.config*.{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.dll\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19006
1060*\SolarWinds.Licensing.MRC.COMWrapper.tlb*.{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.tlb.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19007
1061*\SolarWinds.Logging.dll*.{0,1000}\\SolarWinds\.Logging\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19008
1062*\SolarWinds.MRC.Licensor.exe*.{0,1000}\\SolarWinds\.MRC\.Licensor\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19009
1063*\SolarWinds.MRC.Licensor.exe*.{0,1000}\\SolarWinds\.MRC\.Licensor\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19010
1064*\SolarWinds.MRC.Licensor.exe.config*.{0,1000}\\SolarWinds\.MRC\.Licensor\.exe\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19011
1065*\SolarWinds.MRC.Licensor.log*.{0,1000}\\SolarWinds\.MRC\.Licensor\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19012
1066*\SolarWinds.Pluggability.Contract.dll*.{0,1000}\\SolarWinds\.Pluggability\.Contract\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19013
1067*\SolarWinds.Pluggability.dll*.{0,1000}\\SolarWinds\.Pluggability\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19014
1068*\SolarWinds\Dameware Mini Remote Control*.{0,1000}\\SolarWinds\\Dameware\sMini\sRemote\sControl.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19015
1069*\SolarWinds\Logs\Dameware*.{0,1000}\\SolarWinds\\Logs\\Dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A19016
1070*\SOLARWINDS-DAMEWARE-DRS-ST.EX-*.{0,1000}\\SOLARWINDS\-DAMEWARE\-DRS\-ST\.EX\-.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A19017
1071*\SolarWinds-Dameware-DRS-St.exe*.{0,1000}\\SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A19018
1072*\Splashtop Remote\*.{0,1000}\\Splashtop\sRemote\\.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7210N/AN/A1010N/AN/AN/AN/A19042
1073*\Splashtop\Temp\*.{0,1000}\\Splashtop\\Temp\\.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10N/AN/A1010N/AN/AN/AN/A19043
1074*\Splashtop\Temp\log\FTCLog.txt*.{0,1000}\\Splashtop\\Temp\\log\\FTCLog\.txt.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10N/AN/A1010N/AN/AN/AN/A19044
1075*\spool\drivers\x64\rupd.*.{0,1000}\\spool\\drivers\\x64\\rupd\..{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A19051
1076*\SRService.exe*.{0,1000}\\SRService\.exe.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7210N/AN/A1010N/AN/AN/AN/A19086
1077*\start dameware remote everywhere agent.lnk*.{0,1000}\\start\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19110
1078*\Start Menu\Programs\Advanced Monitoring Agent.lnk*.{0,1000}\\Start\sMenu\\Programs\\Advanced\sMonitoring\sAgent\.lnk.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A19112
1079*\start menu\programs\dameware*.{0,1000}\\start\smenu\\programs\\dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19113
1080*\Start Menu\Programs\DWAgent*.{0,1000}\\Start\sMenu\\Programs\\DWAgent.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z19114
1081*\Start Menu\Programs\LogMeIn Rescue\*.{0,1000}\\Start\sMenu\\Programs\\LogMeIn\sRescue\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A19115
1082*\Start Menu\Programs\LogMeIn*.{0,1000}\\Start\sMenu\\Programs\\LogMeIn.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A19116
1083*\Start Menu\Programs\NetSupport*.{0,1000}\\Start\sMenu\\Programs\\NetSupport.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A19118
1084*\Start Menu\Programs\Radmin Server *.{0,1000}\\Start\sMenu\\Programs\\Radmin\sServer\s.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A19120
1085*\Start Menu\Programs\Radmin Viewer *.{0,1000}\\Start\sMenu\\Programs\\Radmin\sViewer\s.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A19121
1086*\StopSimpleGatewayService.exe*.{0,1000}\\StopSimpleGatewayService\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A19150
1087*\strwinclt.exe*.{0,1000}\\strwinclt\.exe.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7210N/AN/A1010N/AN/AN/AN/A19155
1088*\Supremo Remote Printer\*.{0,1000}\\Supremo\sRemote\sPrinter\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A19172
1089*\Supremo.exe*.{0,1000}\\Supremo\.exe.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A19173
1090*\SUPREMO.EXE-*.pf*.{0,1000}\\SUPREMO\.EXE\-.{0,1000}\.pf.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A19174
1091*\Supremo_Client_2*.{0,1000}\\Supremo_Client_2.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/Apipename1010N/AN/AN/AN/A19175
1092*\Supremo_Helper_2*.{0,1000}\\Supremo_Helper_2.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/Apipename1010N/AN/AN/AN/A19176
1093*\Supremo_Service*.{0,1000}\\Supremo_Service.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/Apipename1010N/AN/AN/AN/A19177
1094*\SupremoHelper.exe*.{0,1000}\\SupremoHelper\.exe.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A19178
1095*\SupremoRemoteDesktop\*.{0,1000}\\SupremoRemoteDesktop\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A19179
1096*\System\CurrentControlSet\Services\ehorus*.{0,1000}\\System\\CurrentControlSet\\Services\\ehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#servicename #registryN/A1010N/AN/AN/AN/A19198
1097*\System\CurrentControlSet\Services\EHORUSAGENT*.{0,1000}\\System\\CurrentControlSet\\Services\\EHORUSAGENT.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#servicename #registryN/A1010N/AN/AN/AN/A19199
1098*\System32\rupdpm.dll*.{0,1000}\\System32\\rupdpm\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A19202
1099*\SysWOW64\rserver30\FamItrf2*.{0,1000}\\SysWOW64\\rserver30\\FamItrf2.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A19206
1100*\SysWOW64\rserver30\FamItrfc*.{0,1000}\\SysWOW64\\rserver30\\FamItrfc.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A19207
1101*\tacticalagent-v*-linux-arm.exe*.{0,1000}\\tacticalagent\-v.{0,1000}\-linux\-arm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z19208
1102*\tacticalagent-v*-windows-amd64.exe*.{0,1000}\\tacticalagent\-v.{0,1000}\-windows\-amd64\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z19209
1103*\tacticalrmm.exe*.{0,1000}\\tacticalrmm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z19210
1104*\tacticalrmm\*.{0,1000}\\tacticalrmm\\.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider* - Black BastaRMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101035384842025-04-22T19:24:13Z2019-10-22T22:19:12Z19211
1105*\TaskCache\Tree\VSA XServiceCheck*.{0,1000}\\TaskCache\\Tree\\VSA\sXServiceCheck.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A19225
1106*\Tasks\PulsewayServiceCheck*.{0,1000}\\Tasks\\PulsewayServiceCheck.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A19228
1107*\tcdirectchat.exe*.{0,1000}\\tcdirectchat\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19231
1108*\tcdirectchatde.dll*.{0,1000}\\tcdirectchatde\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19232
1109*\tcdirectchaten.dll*.{0,1000}\\tcdirectchaten\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19233
1110*\tcdirectchates.dll*.{0,1000}\\tcdirectchates\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19234
1111*\tcdirectchatfr.dll*.{0,1000}\\tcdirectchatfr\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19235
1112*\tcdirectchatit.dll*.{0,1000}\\tcdirectchatit\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19236
1113*\tcdirectchatpt.dll*.{0,1000}\\tcdirectchatpt\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19237
1114*\tcrmtshellagent.exe*.{0,1000}\\tcrmtshellagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19242
1115*\tcrmtshellagent_*.log*.{0,1000}\\tcrmtshellagent_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19243
1116*\tcrmtshellagentmodule_*.{0,1000}\\tcrmtshellagentmodule_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19244
1117*\tcrmtshellviewer.exe*.{0,1000}\\tcrmtshellviewer\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19245
1118*\tcrmtshellviewer_*.log*.{0,1000}\\tcrmtshellviewer_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19246
1119*\tcrmtshellviewermodule_*.{0,1000}\\tcrmtshellviewermodule_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19247
1120*\TeamViewer.exe*.{0,1000}\\TeamViewer\.exe.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19262
1121*\TeamViewer\Connections.txt*.{0,1000}\\TeamViewer\\Connections\.txt.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19263
1122*\TeamViewer\Connections_incoming.txt*.{0,1000}\\TeamViewer\\Connections_incoming\.txt.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19264
1123*\TeamViewer_.ex*.{0,1000}\\TeamViewer_\.ex.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19265
1124*\teamviewer_note.exe*.{0,1000}\\teamviewer_note\.exe.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19266
1125*\TeamViewerSession\shell\open*.{0,1000}\\TeamViewerSession\\shell\\open.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19267
1126*\TeamViewerTermsOfUseAccepted*.{0,1000}\\TeamViewerTermsOfUseAccepted.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19268
1127*\Temp\AnyDeskUninst*.{0,1000}\\Temp\\AnyDeskUninst.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A19274
1128*\TEMP\AteraUpgradeAgentPackage\*.{0,1000}\\TEMP\\AteraUpgradeAgentPackage\\.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A19275
1129*\Temp\install_windows.exe*.{0,1000}\\Temp\\install_windows\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A19291
1130*\TEMP\ScreenConnect\*.ps1*.{0,1000}\\TEMP\\ScreenConnect\\.{0,1000}\.ps1.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMscreenconnect.com10N/AN/A1010N/AN/AN/AN/A19299
1131*\Temp\ScreenConnect\*\setup.msi*.{0,1000}\\Temp\\ScreenConnect\\.{0,1000}\\setup\.msi.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A19300
1132*\Temp\SupremoRemoteDesktop*.{0,1000}\\Temp\\SupremoRemoteDesktop.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A19301
1133*\Temp\XEOX*.{0,1000}\\Temp\\XEOX.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10N/AN/A1010N/AN/AN/AN/A19310
1134*\test_rustdesk.log*.{0,1000}\\test_rustdesk\.log.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101087186123342025-04-22T15:18:36Z2020-09-28T15:36:08Z19316
1135*\TightVNC Server*.{0,1000}\\TightVNC\sServer.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/AN/A1010N/AN/AN/AN/A19348
1136*\tightvnc-*.{0,1000}\\tightvnc\-.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/AN/A1010N/AN/AN/AN/A19349
1137*\TightVNC_Service_Control*.{0,1000}\\TightVNC_Service_Control.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/Anamed pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L21010N/AN/AN/AN/A19350
1138*\tkcuploader.exe*.{0,1000}\\tkcuploader\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19361
1139*\Tools\Ninja.WebSockets.dll*.{0,1000}\\Tools\\Ninja\.WebSockets\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A19390
1140*\Tracing\RemotePCLauncher_*.{0,1000}\\Tracing\\RemotePCLauncher_.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A19412
1141*\Tracing\RemotePCUIU*.{0,1000}\\Tracing\\RemotePCUIU.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A19413
1142*\TransferClient.exe.config*.{0,1000}\\TransferClient\.exe\.config.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A19414
1143*\TransferServer.exe.config*.{0,1000}\\TransferServer\.exe\.config.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A19415
1144*\TV15Install.log*.{0,1000}\\TV15Install\.log.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19455
1145*\TVExtractTemp\TeamViewer_Resource_*.{0,1000}\\TVExtractTemp\\TeamViewer_Resource_.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19456
1146*\TVExtractTemp\tvfiles.7z*.{0,1000}\\TVExtractTemp\\tvfiles\.7z.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19457
1147*\TvGetVersion.dll*.{0,1000}\\TvGetVersion\.dll.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19458
1148*\TVN_log_pipe_public_name*.{0,1000}\\TVN_log_pipe_public_name.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/Anamed pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L21010N/AN/AN/AN/A19459
1149*\TVNetwork.log*.{0,1000}\\TVNetwork\.log.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19460
1150*\TVWebRTC.dll*.{0,1000}\\TVWebRTC\.dll.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19461
1151*\Two Pilots\Agent\Remote Utilities Printer*.{0,1000}\\Two\sPilots\\Agent\\Remote\sUtilities\sPrinter.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A19462
1152*\ultravnc.cer*.{0,1000}\\ultravnc\.cer.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19496
1153*\UltraVNC.ini*.{0,1000}\\UltraVNC\.ini.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19497
1154*\unidrv_rupd.dll*.{0,1000}\\unidrv_rupd\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A19503
1155*\unidrv_rupd.hlp*.{0,1000}\\unidrv_rupd\.hlp.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A19504
1156*\unidrvui_rupd.dll*.{0,1000}\\unidrvui_rupd\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A19505
1157*\Uninstall\MeshCentralAgent*.{0,1000}\\Uninstall\\MeshCentralAgent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103264962025-03-19T18:43:56Z2017-10-12T21:26:52Z19508
1158*\unires_vpd.dll*.{0,1000}\\unires_vpd\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A19510
1159*\Users\Public\Desktop\TVTest.tmp*.{0,1000}\\Users\\Public\\Desktop\\TVTest\.tmp.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19558
1160*\uvnc bvba\UltraVNC\*.{0,1000}\\uvnc\sbvba\\UltraVNC\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19580
1161*\uvnc_launch.exe*.{0,1000}\\uvnc_launch\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A19581
1162*\uvnc_settings.ex*.{0,1000}\\uvnc_settings\.ex.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A19582
1163*\uvnc_settings.exe*.{0,1000}\\uvnc_settings\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19583
1164*\uvnckeyboardhelper.exe*.{0,1000}\\uvnckeyboardhelper\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19584
1165*\Videos\AnyDesk*.{0,1000}\\Videos\\AnyDesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A19612
1166*\ViewerHostKeyPopup.exe*.{0,1000}\\ViewerHostKeyPopup\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A19613
1167*\ViewerHostKeyPopup.exe*.{0,1000}\\ViewerHostKeyPopup\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A19614
1168*\viewer-portable-7.2.2.0\*.{0,1000}\\viewer\-portable\-7\.2\.2\.0\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A19615
1169*\vncviewer.exe*.{0,1000}\\vncviewer\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19626
1170*\VPDAgent.exe*.{0,1000}\\VPDAgent\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A19634
1171*\VSA X Manager.lnk*.{0,1000}\\VSA\sX\sManager\.lnk.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A19636
1172*\VSA X Remote Control.lnk*.{0,1000}\\VSA\sX\sRemote\sControl\.lnk.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A19637
1173*\VSA X Remote Control\*.{0,1000}\\VSA\sX\sRemote\sControl\\.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A19638
1174*\VSA X\watchdog.bat*.{0,1000}\\VSA\sX\\watchdog\.bat.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A19639
1175*\VSA XServiceCheck*.{0,1000}\\VSA\sXServiceCheck.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A19640
1176*\VSAX\working*.{0,1000}\\VSAX\\working.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A19642
1177*\VSAX_x64.msi*.{0,1000}\\VSAX_x64\.msi.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A19643
1178*\vsxrc-clip.exe*.{0,1000}\\vsxrc\-clip\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A19644
1179*\Win7Taskbar.dll*.{0,1000}\\Win7Taskbar\.dll.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A19714
1180*\Windows\Action1\scripts\*.{0,1000}\\Windows\\Action1\\scripts\\.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A19720
1181*\Windows\system32\SubDir\Client.exe*.{0,1000}\\Windows\\system32\\SubDir\\Client\.exe.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10918725512024-02-29T06:37:37Z2014-07-08T12:27:59Z19733
1182*\Windows\SysWOW64\rserver30\*.{0,1000}\\Windows\\SysWOW64\\rserver30\\.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A19735
1183*\Windows\Temp\ScreenConnect\*.cmd*.{0,1000}\\Windows\\Temp\\ScreenConnect\\.{0,1000}\.cmd.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A19757
1184*\Windows\Temp\ScreenConnect\*.ps1*.{0,1000}\\Windows\\Temp\\ScreenConnect\\.{0,1000}\.ps1.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A19758
1185*\Windows\Temp\TeamViewer*.{0,1000}\\Windows\\Temp\\TeamViewer.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A19763
1186*\WindowsApps\MicrosoftCorporationII.QuickAssist_*.{0,1000}\\WindowsApps\\MicrosoftCorporationII\.QuickAssist_.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A19771
1187*\winpty-agent64.exe*.{0,1000}\\winpty\-agent64\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A19800
1188*\WinSxS\amd64_microsoft-windows-quickassist_*.{0,1000}\\WinSxS\\amd64_microsoft\-windows\-quickassist_.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A19807
1189*\winvnc.exe*.{0,1000}\\winvnc\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19808
1190*\winvncsc.exe*.{0,1000}\\winvncsc\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19809
1191*\winwvc.exe*.{0,1000}\\winwvc\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A19810
1192*\WOW6432Node\Citrix\GoToMyPc*.{0,1000}\\WOW6432Node\\Citrix\\GoToMyPc.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A19857
1193*\wow6432node\multiplicar negocios\bace_dameware*.{0,1000}\\wow6432node\\multiplicar\snegocios\\bace_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A19860
1194*\WOW6432Node\RemotePC*.{0,1000}\\WOW6432Node\\RemotePC.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A19861
1195*\WOW6432Node\Splashtop Inc.\Splashtop Remote Server*.{0,1000}\\WOW6432Node\\Splashtop\sInc\.\\Splashtop\sRemote\sServer.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10N/AN/A1010N/AN/AN/AN/A19862
1196*\x64\monblanking.sys*.{0,1000}\\x64\\monblanking\.sys.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A19888
1197*\XEOX\Agent Watchdog on Boot*.{0,1000}\\XEOX\\Agent\sWatchdog\son\sBoot.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10#scheduledtaskN/A1010N/AN/AN/AN/A19900
1198*\XEOX\Agent Watchdog on Wakeup*.{0,1000}\\XEOX\\Agent\sWatchdog\son\sWakeup.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10#scheduledtaskN/A1010N/AN/AN/AN/A19901
1199*\XEOX\Agent Watchdog*.{0,1000}\\XEOX\\Agent\sWatchdog.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10#scheduledtaskN/A1010N/AN/AN/AN/A19902
1200*\XEOX_cloud_agent_install.bat*.{0,1000}\\XEOX_cloud_agent_install\.bat.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10N/AN/A1010N/AN/AN/AN/A19903
1201*\XEOXAgent.exe*.{0,1000}\\XEOXAgent\.exe.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10N/AN/A1010N/AN/AN/AN/A19904
1202*\xeox-agent_x64\*.{0,1000}\\xeox\-agent_x64\\.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10N/AN/A1010N/AN/AN/AN/A19905
1203*\ZA_Connect.exe*.{0,1000}\\ZA_Connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19942
1204*\ZA_Upgrader*.{0,1000}\\ZA_Upgrader.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19943
1205*\ZAAudioClient.exe*.{0,1000}\\ZAAudioClient\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19944
1206*\ZAFileTransfer.exe*.{0,1000}\\ZAFileTransfer\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19945
1207*\ZAService.exe*.{0,1000}\\ZAService\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19946
1208*\ZAudioClientPipe_*ServerReadPipe*.{0,1000}\\ZAudioClientPipe_.{0,1000}ServerReadPipe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19947
1209*\ZAudioClientPipe_*ServerWritePipe*.{0,1000}\\ZAudioClientPipe_.{0,1000}ServerWritePipe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19948
1210*\ZMAgent.exe*.{0,1000}\\ZMAgent\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19958
1211*\Zoho Assist\Zoho Assist Remote support*.{0,1000}\\Zoho\sAssist\\Zoho\sAssist\sRemote\ssupport.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19959
1212*\ZohoMeeting.7z*.{0,1000}\\ZohoMeeting\.7z.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19960
1213*\ZohoMeeting.exe*.{0,1000}\\ZohoMeeting\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19961
1214*\ZohoMeeting\agent.exe*.{0,1000}\\ZohoMeeting\\agent\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19962
1215*\zohomeeting\agent.exe*.{0,1000}\\zohomeeting\\agent\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19963
1216*\ZohoMeeting\agent_ui.exe*.{0,1000}\\ZohoMeeting\\agent_ui\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19964
1217*\ZohoMeeting\Connect.exe*.{0,1000}\\ZohoMeeting\\Connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19965
1218*\ZohoMeeting\Connection.conf*.{0,1000}\\ZohoMeeting\\Connection\.conf.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19966
1219*\ZohoMeeting\log\*.log*.{0,1000}\\ZohoMeeting\\log\\.{0,1000}\.log.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19967
1220*\ZohoMeeting\ViewerUI.exe*.{0,1000}\\ZohoMeeting\\ViewerUI\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19968
1221*\ZohoTray.exe*.{0,1000}\\ZohoTray\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19969
1222*\ZohoURS.exe*.{0,1000}\\ZohoURS\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19970
1223*\ZohoURSService.exe*.{0,1000}\\ZohoURSService\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A19971
1224*_Classes\zohoassistlaunchv2*.{0,1000}_Classes\\zohoassistlaunchv2.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A20112
1225*_NetSupport_NetSupport Manager_*.{0,1000}_NetSupport_NetSupport\sManager_.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A20144
1226*_renamed_by_Action1*.{0,1000}_renamed_by_Action1.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A20169
1227*<\Level\Level Watchdog>*.{0,1000}\<\\Level\\Level\sWatchdog\>.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A20199
1228*<a href="rutils:*.{0,1000}\<a\shref\=\"rutils\:.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A20202
1229*<Alpemix>*.{0,1000}\<Alpemix\>.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A20203
1230*<AlpemixWEB>*.{0,1000}\<AlpemixWEB\>.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A20204
1231*<data>dameware remote everywhere</data>*.{0,1000}\<data\>dameware\sremote\severywhere\<\/data\>.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A20214
1232*<Data>Installed GoToMyPC</Data>*.{0,1000}\<Data\>Installed\sGoToMyPC\<\/Data\>.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A20215
1233*<Data>LogMeIn, Inc.</Data>*.{0,1000}\<Data\>LogMeIn,\sInc\.\<\/Data\>.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A20216
1234*<data>n-able take control</data>*.{0,1000}\<data\>n\-able\stake\scontrol\<\/data\>.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A20217
1235*<Data>Product: Chrome Remote Desktop Host*.{0,1000}\<Data\>Product\:\sChrome\sRemote\sDesktop\sHost.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10#productnameN/A1010N/AN/AN/AN/A20218
1236*<Data>Product: Remote Utilities - Host -- *.{0,1000}\<Data\>Product\:\sRemote\sUtilities\s\-\sHost\s\-\-\s.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A20219
1237*<Data>Pulseway Remote Control</Data>*.{0,1000}\<Data\>Pulseway\sRemote\sControl\<\/Data\>.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A20220
1238*<Data>Received Request Execute automation * script * from device Id*.{0,1000}\<Data\>Received\sRequest\sExecute\sautomation\s.{0,1000}\sscript\s.{0,1000}\sfrom\sdevice\sId.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A20221
1239*<Data>Received Request Get RD pool score *pulseway.com/remote*.{0,1000}\<Data\>Received\sRequest\sGet\sRD\spool\sscore\s.{0,1000}pulseway\.com\/remote.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A20222
1240*<Data>Remote Utilities - Host</Data>*.{0,1000}\<Data\>Remote\sUtilities\s\-\sHost\<\/Data\>.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A20223
1241*<Data>Remote Utilities Server<*.{0,1000}\<Data\>Remote\sUtilities\sServer\<.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A20224
1242*<Data>Removed Remote Utilities - Host.</Data>*.{0,1000}\<Data\>Removed\sRemote\sUtilities\s\-\sHost\.\<\/Data\>.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A20225
1243*<Data>ScreenConnect Software</Data>*.{0,1000}\<Data\>ScreenConnect\sSoftware\<\/Data\>.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A20226
1244*<Provider Name="chromoting" />*.{0,1000}\<Provider\sName\=\"chromoting\".{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/Awindows event logs application provider name1010N/AN/AN/AN/A20249
1245*<provider name="dameware remote everywhere - [dameware]" />*.{0,1000}\<provider\sname\=\"dameware\sremote\severywhere\s\-\s\[dameware\]\"\s\/\>.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A20250
1246*<Provider Name="PC Monitor" />*.{0,1000}\<Provider\sName\=\"PC\sMonitor\"\s\/\>.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A20251
1247*<Provider Name="Pulseway" />*.{0,1000}\<Provider\sName\=\"Pulseway\"\s\/\>.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Back BastaRMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A20252
1248*<Provider Name='Quick Assist'/>*.{0,1000}\<Provider\sName\=\'Quick\sAssist\'\/\>.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A20253
1249*<Provider Name='ScreenConnect Security Manager'/>*.{0,1000}\<Provider\sName\=\'ScreenConnect\sSecurity\sManager\'\/\>.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A20254
1250*<Provider Name='ScreenConnect Web Server'/>*.{0,1000}\<Provider\sName\=\'ScreenConnect\sWeb\sServer\'\/\>.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A20255
1251*<Teknopars Bilisim>*.{0,1000}\<Teknopars\sBilisim\>.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A20258
1252*=http://www.gotomypc.com/downloads/viewer *.{0,1000}\=http\:\/\/www\.gotomypc\.com\/downloads\/viewer\s.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A20293
1253*=NetSupport Client_deleteme*.{0,1000}\=NetSupport\sClient_deleteme.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A20296
1254*>Anyplace Control Software<*.{0,1000}\>Anyplace\sControl\sSoftware\<.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A20329
1255*>AnyViewer Setup<*.{0,1000}\>AnyViewer\sSetup\<.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A20330
1256*>AnyViewer<*.{0,1000}\>AnyViewer\<.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A20331
1257*>Atera Networks<*.{0,1000}\>Atera\sNetworks\<.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10#companynameN/A1010N/AN/AN/AN/A20332
1258*>Auvik Networks Inc.<*.{0,1000}\>Auvik\sNetworks\sInc\.\<.{0,1000}greyware_tool_keywordauvikcloud-based network management softwareT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.auvik.com/10N/AN/A1010N/AN/AN/AN/A20335
1259*>AweRay Limited<*.{0,1000}\>AweRay\sLimited\<.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A20336
1260*>AweRay Pte. Ltd.<*.{0,1000}\>AweRay\sPte\.\sLtd\.\<.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A20337
1261*>AweSun.exe<*.{0,1000}\>AweSun\.exe\<.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A20338
1262*>AweSun<*.{0,1000}\>AweSun\<.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A20339
1263*>Barracuda MSP<*.{0,1000}\>Barracuda\sMSP\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A20341
1264*>Barracuda Networks, Inc.*.{0,1000}\>Barracuda\sNetworks,\sInc\..{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A20342
1265*>Barracuda RMM Setup AutoRun<*.{0,1000}\>Barracuda\sRMM\sSetup\sAutoRun\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A20343
1266*>Barracuda RMM Setup<*.{0,1000}\>Barracuda\sRMM\sSetup\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A20344
1267*>Barracuda RMM*<*.{0,1000}\>Barracuda\sRMM.{0,1000}\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A20345
1268*>Bomgar Corporation</Data>*\>Bomgar\sCorporation\<\/Data\>.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A20349
1269*>DWAgent<*.{0,1000}\>DWAgent\<.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider* - Black BastaRMMhttps://github.com/dwservice/agent10N/AN/A105471832023-03-22T08:45:16Z2019-01-23T10:40:24Z20382
1270*>eHorus Agent Setup<*.{0,1000}\>eHorus\sAgent\sSetup\<.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#descriptionN/A1010N/AN/AN/AN/A20385
1271*>EHORUSAGENT<*.{0,1000}\>EHORUSAGENT\<.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#servicenameN/A1010N/AN/AN/AN/A20386
1272*>Famatech Corp.<*.{0,1000}\>Famatech\sCorp\.\<.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10#companynameN/A1010N/AN/AN/AN/A20392
1273*>FleetDeck Inc<*.{0,1000}\>FleetDeck\sInc\<.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10#companynameN/A101048965582025-04-22T21:05:02Z2020-11-03T22:17:18Z20396
1274*>Installed Remote Utilities - Viewer.*.{0,1000}\>Installed\sRemote\sUtilities\s\-\sViewer\..{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A20416
1275*>Installed Remote Utilities Server.</*.{0,1000}\>Installed\sRemote\sUtilities\sServer\.\<\/.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A20417
The file is too large to be shown. View Raw
Reference in New Issue View Git Blame Copy Permalink