admin/mthcht-ThreatHunting-Keywords
1
0
Fork 0
mirror of https://github.com/mthcht/ThreatHunting-Keywords synced 2026-06-08 16:12:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
mthcht-ThreatHunting-Keywords/RMM_detection.csv
T
mthcht 553d088f80 spliting into additional lists + updated tags
2025-01-08 12:39:55 +01:00

1019 KiB
Raw Permalink Blame History

1keywordmetadata_keyword_regexmetadata_keyword_typemetadata_toolmetadata_descriptionmetadata_tool_techniquesmetadata_tool_tacticsmetadata_malwares_namemetadata_groups_namemetadata_categorymetadata_linkmetadata_enable_endpoint_detectionmetadata_enable_proxy_detectionmetadata_tagsmetadata_commentmetadata_severity_scoremetadata_popularity_scoremetadata_github_starsmetadata_github_forksmetadata_github_updated_atmetadata_github_created_at
2* ./level-darwin-bundle-amd64.pkg*.{0,1000}\s\.\/level\-darwin\-bundle\-amd64\.pkg.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A
3* ./level-linux-amd64 *.{0,1000}\s\.\/level\-linux\-amd64\s.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A
4* ./level-linux-arm64 *.{0,1000}\s\.\/level\-linux\-arm64\s.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A
5* /EV"NetSupport School"*.{0,1000}\s\/EV\"NetSupport\sSchool\".{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
6* /f /im RemotePCS*.{0,1000}\s\/f\s\/im\sRemotePCS.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
7* /F /TN "Level\Level Watchdog"*.{0,1000}\s\/F\s\/TN\s\"Level\\Level\sWatchdog\".{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
8* /monitor /from_service /cpu_memory_refresh * /disk_space_refresh * /proc_list_refresh * /semkey *.{0,1000}\s\/monitor\s\/from_service\s\/cpu_memory_refresh\s.{0,1000}\s\/disk_space_refresh\s.{0,1000}\s\/proc_list_refresh\s.{0,1000}\s\/semkey\s.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
9* <Data>Received Request Run command *</Data>*.{0,1000}\s\<Data\>Received\sRequest\sRun\scommand\s.{0,1000}\<\/Data\>.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
10* -a tcrmtshellagentmodule_*.{0,1000}\s\-a\stcrmtshellagentmodule_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
11* aeroadmin.exe*.{0,1000}\saeroadmin\.exe.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A
12* -altgw *.zohoassist.com *.{0,1000}\s\-altgw\s.{0,1000}\.zohoassist\.com\s.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
13* chrome-remote-desktop@*.{0,1000}\schrome\-remote\-desktop\@.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
14* CN=Quasar Server CA*.{0,1000}\sCN\=Quasar\sServer\sCA.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
15* Connection #*. Connection to "*" established. Mode: <Remote control>.*.{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\".{0,1000}\"\sestablished\.\sMode\:\s\<Remote\scontrol\>\..{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#contentN/A1010N/AN/AN/AN/A
16* Connection #*. Connection to "*". Security check - OK. Mode: <Inventory manager>*.{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\".{0,1000}\"\.\sSecurity\scheck\s\-\sOK\.\sMode\:\s\s\<Inventory\smanager\>.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#contentN/A1010N/AN/AN/AN/A
17* Connection #*. Connection to "*". Security check - OK. Mode: <Command (command: *)>.{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\".{0,1000}\"\.\sSecurity\scheck\s\-\sOK\.\sMode\:\s\<Command\s\(command\:\s.{0,1000}\)\>greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#contentN/A1010N/AN/AN/AN/A
18* Connection #*. Direct connection to * (*:5650).*.{0,1000}\sConnection\s\#.{0,1000}\.\sDirect\sconnection\sto\s.{0,1000}\s\(.{0,1000}\:5650\)\..{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#contentN/A1010N/AN/AN/AN/A
19* create RPCService start=*.{0,1000}\screate\sRPCService\sstart\=.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
20* create ViewerService start=auto*.{0,1000}\screate\sViewerService\sstart\=auto.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
21* Dameware Mini Remote Control x64 -- Installation completed successfully*.{0,1000}\sDameware\sMini\sRemote\sControl\sx64\s\-\-\sInstallation\scompleted\ssuccessfully.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
22* downloads.level.io*.{0,1000}\sdownloads\.level\.io.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
23* DownloadServer=https://www.gotomypc.com *.{0,1000}\sDownloadServer\=https\:\/\/www\.gotomypc\.com\s.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
24* gotoopener://launch.getgo.com/*.{0,1000}\sgotoopener\:\/\/launch\.getgo\.com\/.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
25* -i remotepc.deb*.{0,1000}\s\-i\sremotepc\.deb.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
26* install meshcentral*.{0,1000}\sinstall\smeshcentral.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
27* install-fleetctl.sh*.{0,1000}\sinstall\-fleetctl\.sh.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
28* LoggingServer=logging.getgo.com ProxyHost=*.{0,1000}\sLoggingServer\=logging\.getgo\.com\sProxyHost\=.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
29* -log-level trace -dre -log-path *.{0,1000}\s\-log\-level\strace\s\-dre\s\-log\-path\s.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
30* meshcentral.service*.{0,1000}\smeshcentral\.service.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
31* -ms assist.zoho.com -p 443*.{0,1000}\s\-ms\sassist\.zoho\.com\s\-p\s443.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
32* -name:* -password:* -remoteexecute -filename*.{0,1000}\s\-name\:.{0,1000}\s\-password\:.{0,1000}\s\-remoteexecute\s\-filename.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
33* -omeshcmd.exe -imodule1.js*.{0,1000}\s\-omeshcmd\.exe\s\-imodule1\.js.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
34* PCMonitorManager.exe*.{0,1000}\sPCMonitorManager\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
35* PCMonitorSrv.exe*.{0,1000}\sPCMonitorSrv\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
36* pcmontask.exe*.{0,1000}\spcmontask\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
37* pulseway_x64.deb*.{0,1000}\spulseway_x64\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
38* Pulseway_x64.msi*.{0,1000}\sPulseway_x64\.msi.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
39* pulseway_x86.deb*.{0,1000}\spulseway_x86\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
40* RemoteDesktop.exe*.{0,1000}\sRemoteDesktop\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
41* RemotePC.exe*.{0,1000}\sRemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
42* RemotePCAttendedService *.{0,1000}\sRemotePCAttendedService\s.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
43* remotepclauncher.exe*.{0,1000}\sremotepclauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
44* remotepcuiu.exe*.{0,1000}\sremotepcuiu\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
45* RemotePCViewer.msi*.{0,1000}\sRemotePCViewer\.msi.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
46* rmm-installer.ps1*.{0,1000}\srmm\-installer\.ps1.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
47* rpcdownloader.exe*.{0,1000}\srpcdownloader\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
48* rpcperfviewer.exe*.{0,1000}\srpcperfviewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
49* RPCWinXP.exe*.{0,1000}\sRPCWinXP\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
50* -rr_flag * -group * -fileTransferGateways *.zohoassist.com -ADMINAGENT*.{0,1000}\s\-rr_flag\s.{0,1000}\s\-group\s.{0,1000}\s\-fileTransferGateways\s.{0,1000}\.zohoassist\.com\s\-ADMINAGENT.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
51* RustDesk.exe*.{0,1000}\sRustDesk\.exe.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
52* SELECT ProcessId FROM Win32_Process * Name='ZAAudioClient.exe'*.{0,1000}\sSELECT\sProcessId\sFROM\sWin32_Process\s.{0,1000}\sName\=\'ZAAudioClient\.exe\'.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
53* -service TightVNC Server*.{0,1000}\s\-service\sTightVNC\sServer.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/AN/A1010N/AN/AN/AN/A
54* start rustdesk://*.{0,1000}\sstart\srustdesk\:\/\/.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
55* start SupremoService*.{0,1000}\sstart\sSupremoService.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
56* start uvnc_service*.{0,1000}\sstart\suvnc_service.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
57* stop uvnc_service*.{0,1000}\sstop\suvnc_service.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
58* Supremo.exe*.{0,1000}\sSupremo\.exe.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
59* tacticalrmm.exe*.{0,1000}\stacticalrmm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
60* tkc_agent_dre.deb*.{0,1000}\stkc_agent_dre\.deb.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
61* ultravnc.ini *.{0,1000}\sultravnc\.ini\s.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
62* upload*.systemmonitor.eu.com*/command/agentprocessor*.{0,1000}\supload.{0,1000}\.systemmonitor\.eu\.com.{0,1000}\/command\/agentprocessor.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm11N/AN/A1010N/AN/AN/AN/A
63* vnc.ini *.{0,1000}\svnc\.ini\s.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
64* VSAX_x64.msi*.{0,1000}\sVSAX_x64\.msi.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
65* --webview-exe-name=QuickAssist.exe*.{0,1000}\s\-\-webview\-exe\-name\=QuickAssist\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
66* ZA_Connect.exe*.{0,1000}\sZA_Connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
67* ZAAudioClient.exe*.{0,1000}\sZAAudioClient\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
68* ZAFileTransfer.exe*.{0,1000}\sZAFileTransfer\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
69* ZAService.exe*.{0,1000}\sZAService\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
70*"message":"ably connection state: CONNECTED"}*.{0,1000}\"message\"\:\"ably\sconnection\sstate\:\sCONNECTED\"\}.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
71*"publisher":"uvnc bvba*.{0,1000}\"publisher\"\:\"uvnc\sbvba.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry value1010N/AN/AN/AN/A
72*"RemotePCAttendedService"*.{0,1000}\"RemotePCAttendedService\".{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
73*"SimpleHelp Remote Printer"*.{0,1000}\"SimpleHelp\sRemote\sPrinter\".{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
74*$env:LEVEL_API_KEY = "*";*.{0,1000}\$env\:LEVEL_API_KEY\s\=\s\".{0,1000}\"\;.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
75*$tempFile = Join-Path ([System.IO.Path]::GetTempPath()) "install_windows.exe";*.{0,1000}\$tempFile\s\=\sJoin\-Path\s\(\[System\.IO\.Path\]\:\:GetTempPath\(\)\)\s\"install_windows\.exe\"\;.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
76*.\TightVNC1*.{0,1000}\.\\TightVNC1.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10#registryregistry1010N/AN/AN/AN/A
77*.\TightVNC2*.{0,1000}\.\\TightVNC2.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10#registryregistry1010N/AN/AN/AN/A
78*.\TightVNC3*.{0,1000}\.\\TightVNC3.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10#registryregistry1010N/AN/AN/AN/A
79*.api.splashtop.com*.{0,1000}\.api\.splashtop\.com.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7211N/AN/A1010N/AN/AN/AN/A
80*.apitest.barracudamsp.com*.{0,1000}\.apitest\.barracudamsp\.com.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm11N/AN/A1010N/AN/AN/AN/A
81*.aweray.net*.{0,1000}\.aweray\.net.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com11N/AN/A1010N/AN/AN/AN/A
82*.beyondtrustcloud.com/session_complete*.{0,1000}\.beyondtrustcloud\.com\/session_complete.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/11N/AN/A1010N/AN/AN/AN/A
83*.chrome-remote-desktop-session*.{0,1000}\.chrome\-remote\-desktop\-session.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
84*.comodo.com/static/frontend/static-pages/enroll-wizard/token*.{0,1000}\.comodo\.com\/static\/frontend\/static\-pages\/enroll\-wizard\/token.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/11N/AN/A1010N/AN/AN/AN/A
85*.console.gotoassist.com*.{0,1000}\.console\.gotoassist\.com.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com11N/AN/A1010N/AN/AN/AN/A
86*.dev1.fleetdeck.io*.{0,1000}\.dev1\.fleetdeck\.io.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
87*.exe --IPCport 5939 --Module 1*.{0,1000}\.exe\s\-\-IPCport\s5939\s\-\-Module\s1.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/11N/Ahttps://github.com/SigmaHQ/sigma/pull/47591010N/AN/AN/AN/A
88*.exe --pn dre_video_uploader --logpath logs*.{0,1000}\.exe\s\-\-pn\sdre_video_uploader\s\-\-logpath\slogs.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
89*.meshagent.pid*.{0,1000}\.meshagent\.pid.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
90*.mspa.n-able.com*.{0,1000}\.mspa\.n\-able\.com.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software11N/AN/A1010N/AN/AN/AN/A
91*.relay.splashtop.com*.{0,1000}\.relay\.splashtop\.com.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7211N/AN/A1010N/AN/AN/AN/A
92*.remotepc.com*.{0,1000}\.remotepc\.com.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A
93*.remotepc.com*.{0,1000}\.remotepc\.com.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/Anetwork1010N/AN/AN/AN/A
94*.remoteutilities.com*.{0,1000}\.remoteutilities\.com.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A
95*.remoteview.logmein.com*.{0,1000}\.remoteview\.logmein\.com.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com11N/AN/A1010N/AN/AN/AN/A
96*.router.teamviewer.com*.{0,1000}\.router\.teamviewer\.com.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/11N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
97*.servicedesk.atera.com/GetAgent*.{0,1000}\.servicedesk\.atera\.com\/GetAgent.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/11N/AN/A1010N/AN/AN/AN/A
98*.vsax.net*.{0,1000}\.vsax\.net.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
99*.xeox.com*.{0,1000}\.xeox\.com.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/11N/AN/A1010N/AN/AN/AN/A
100*.zohoassist.com.cn*.{0,1000}\.zohoassist\.com\.cn.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A
101*.zohoassist.jp*.{0,1000}\.zohoassist\.jp.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A
102*/.anydesk/.anydesk.trace*.{0,1000}\/\.anydesk\/\.anydesk\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
103*/.anydesk/service.conf*.{0,1000}\/\.anydesk\/service\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
104*/.anydesk/system.conf*.{0,1000}\/\.anydesk\/system\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
105*/.anydesk/user.conf*.{0,1000}\/\.anydesk\/user\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
106*/.fleetctl/fleetctl*.{0,1000}\/\.fleetctl\/fleetctl.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
107*/action1_agent(My_Organization).msi*.{0,1000}\/action1_agent\(My_Organization\)\.msi.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/11N/Aproduct name1010N/AN/AN/AN/A
108*/aeroadmin.exe*.{0,1000}\/aeroadmin\.exe.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A
109*/Agent/AcknowledgeCommands/*.{0,1000}\/Agent\/AcknowledgeCommands\/.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
110*/Agent/GetCommandsFallback/*.{0,1000}\/Agent\/GetCommandsFallback\/.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
111*/Agent/GetEnvironmentStatus/*.{0,1000}\/Agent\/GetEnvironmentStatus\/.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
112*/Agent/GetRecurringPackages/*.{0,1000}\/Agent\/GetRecurringPackages\/.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
113*/Alpemix.zip*.{0,1000}\/Alpemix\.zip.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/11N/AN/A1010N/AN/AN/AN/A
114*/amidaware/rmmagent/releases/download/*.{0,1000}\/amidaware\/rmmagent\/releases\/download\/.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
115*/Anydesk.exe.{0,1000}\/Anydesk\.exegreyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/11N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
116*/anyplace-control/data2/*.exe*.{0,1000}\/anyplace\-control\/data2\/.{0,1000}\.exe.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com11N/AN/A1010N/AN/AN/AN/A
117*/AnyViewerSetup.exe*.{0,1000}\/AnyViewerSetup\.exe.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com11N/AN/A1010N/AN/AN/AN/A
118*/Apemix.exe*.{0,1000}\/Apemix\.exe.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/11N/AN/A1010N/AN/AN/AN/A
119*/api/latest/fleet/mdm/bootstrap?token=*.{0,1000}\/api\/latest\/fleet\/mdm\/bootstrap\?token\=.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
120*/api/v1/fleet/mdm/sso/callback*.{0,1000}\/api\/v1\/fleet\/mdm\/sso\/callback.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
121*/Applications/Anydesk.app/*.{0,1000}\/Applications\/Anydesk\.app\/.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
122*/Applications/Managed Workplace/Onsite Manager/logs/*.{0,1000}\/Applications\/Managed\sWorkplace\/Onsite\sManager\/logs\/.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
123*/Assistance rapide Installer.exe*.{0,1000}\/Assistance\srapide\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx511N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
124*/Assistenza rapida Installer.exe*.{0,1000}\/Assistenza\srapida\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx511N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
125*/AttendedUDP.zip*.{0,1000}\/AttendedUDP\.zip.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A
126*/Aweray_Remote_*.exe*.{0,1000}\/Aweray_Remote_.{0,1000}\.exe.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com11N/AN/A1010N/AN/AN/AN/A
127*/Aweray_Remote_*.zip*.{0,1000}\/Aweray_Remote_.{0,1000}\.zip.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com11N/AN/A1010N/AN/AN/AN/A
128*/bin/meshagent*.{0,1000}\/bin\/meshagent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10#linuxN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
129*/bin/MeshCommander*.{0,1000}\/bin\/MeshCommander.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10#linuxN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
130*/bomgar-rep.exe*.{0,1000}\/bomgar\-rep\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/11N/AN/A1010N/AN/AN/AN/A
131*/bomgar-rep-installer.exe*.{0,1000}\/bomgar\-rep\-installer\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
132*/bomgar-scc-*.exe*.{0,1000}\/bomgar\-scc\-.{0,1000}\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/11N/AN/A1010N/AN/AN/AN/A
133*/bomgar-scc.exe*.{0,1000}\/bomgar\-scc\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/11N/AN/A1010N/AN/AN/AN/A
134*/Create /TN TVInstallRestore /TR *.{0,1000}\/Create\s\/TN\sTVInstallRestore\s\/TR\s.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
135*/damewareagent.exe*.{0,1000}\/damewareagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software11N/AN/A1010N/AN/AN/AN/A
136*/downloads/ultravnc.html*.{0,1000}\/downloads\/ultravnc\.html.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html11N/AN/A1010N/AN/AN/AN/A
137*/dwagent.desktop*.{0,1000}\/dwagent\.desktop.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
138*/dwagent.service*.{0,1000}\/dwagent\.service.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
139*/dwagsystray*.{0,1000}\/dwagsystray.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
140*/DWMRC_St_64.msi*.{0,1000}\/DWMRC_St_64\.msi.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control11N/ADameware Mini Remote Control1010N/AN/AN/AN/A
141*/DWRCC.exe*.{0,1000}\/DWRCC\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control11N/ADameware Mini Remote Control1010N/AN/AN/AN/A
142*/DWRCCMD.exe*.{0,1000}\/DWRCCMD\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control11N/ADameware Mini Remote Control1010N/AN/AN/AN/A
143*/DWRCS.exe*.{0,1000}\/DWRCS\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control11N/ADameware Mini Remote Control1010N/AN/AN/AN/A
144*/etc/ehorus/ehorus_agent*.{0,1000}\/etc\/ehorus\/ehorus_agent.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A
145*/etc/fleet/fleet.env*.{0,1000}\/etc\/fleet\/fleet\.env.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10#linuxN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
146*/etc/init.d/ehorus_agent_daemon*.{0,1000}\/etc\/init\.d\/ehorus_agent_daemon.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A
147*/etc/level/config.yaml*.{0,1000}\/etc\/level\/config\.yaml.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A
148* /r /proxy /proxyport /proxyusername /proxypasswd *.{0,1000}\s\/r\s\/proxy\s\s\/proxyport\s\s\/proxyusername\s\s\/proxypasswd\s.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10#linuxN/A1010N/AN/AN/AN/A
149*/etc/pulseway/config.xml*.{0,1000}\/etc\/pulseway\/config\.xml.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10#linuxN/A1010N/AN/AN/AN/A
150*/etc/systemd/system/anydesk.service*.{0,1000}\/etc\/systemd\/system\/anydesk\.service.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A
151*"appName":"eHorus Agent"*.{0,1000}\"appName\"\:\"eHorus\sAgent\".{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#registryN/A1010N/AN/AN/AN/A
152* /register /proxy /proxyport /proxyusername /proxypasswd*.{0,1000}\s\/register\s\s\/proxy\s\s\/proxyport\s\s\/proxyusername\s\s\/proxypasswd.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10#linuxN/A1010N/AN/AN/AN/A
153*/ehorus_agent_installer-*.{0,1000}\/ehorus_agent_installer\-.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/11N/AN/A1010N/AN/AN/AN/A
154*/usr/sbin/userdel -r ehorus*.{0,1000}\/usr\/sbin\/userdel\s\-r\sehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
155*/usr/share/ehorus*.{0,1000}\/usr\/share\/ehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
156*\eHorus Agent Menu.lnk*.{0,1000}\\eHorus\sAgent\sMenu\.lnk.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
157*/fleet_v*_linux.tar.gz*.{0,1000}\/fleet_v.{0,1000}_linux\.tar\.gz.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
158*/fleetd.crx*.{0,1000}\/fleetd\.crx.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
159*/fleetdm/fleet/releases/download/*.{0,1000}\/fleetdm\/fleet\/releases\/download\/.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
160*/fleetdm/fleet/releases/latest*.{0,1000}\/fleetdm\/fleet\/releases\/latest.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
161*\eHorus Agent.lnk*.{0,1000}\\eHorus\sAgent\.lnk.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
162*\ehorus standalone.exe*.{0,1000}\\ehorus\sstandalone\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
163*\ehorus_agent.conf*.{0,1000}\\ehorus_agent\.conf.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
164*\ehorus_agent.exe*.{0,1000}\\ehorus_agent\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
165*\ehorus_agent.log*.{0,1000}\\ehorus_agent\.log.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#logfileN/A1010N/AN/AN/AN/A
166*\ehorus_agent_disconn.log*.{0,1000}\\ehorus_agent_disconn\.log.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#logfileN/A1010N/AN/AN/AN/A
167*\ehorus_cmd.exe*.{0,1000}\\ehorus_cmd\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
168*\ehorus_display.exe*.{0,1000}\\ehorus_display\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
169*\ehorus_installer_windows-*.{0,1000}\\ehorus_installer_windows\-.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
170*/home/*/.anydesk/*.{0,1000}\/home\/.{0,1000}\/\.anydesk\/.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A
171*/home/user/rustdesk*.{0,1000}\/home\/user\/rustdesk.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10#linuxN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
172*\ehorus_launcher.exe*.{0,1000}\\ehorus_launcher\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
173*/host-7.2.2.0.msi*.{0,1000}\/host\-7\.2\.2\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A
174*\ehorus_uit.exe*.{0,1000}\\ehorus_uit\.exe.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
175*/HVNC.git*.{0,1000}\/HVNC\.git.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC11N/AN/A1054231262022-02-14T02:31:56Z2021-09-03T17:34:44Z
176*\eHorusMsiCustomActions.dll*.{0,1000}\\eHorusMsiCustomActions\.dll.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
177*\Microsoft\Windows\Start Menu\Programs\eHorus Agent\*.{0,1000}\\Microsoft\\Windows\\Start\sMenu\\Programs\\eHorus\sAgent\\.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
178*\Program Files\ehorus_agent\*.{0,1000}\\Program\sFiles\\ehorus_agent\\.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
179*/install-fleetctl.sh*.{0,1000}\/install\-fleetctl\.sh.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
180*\SOFTWARE\eHorusDispl\*.{0,1000}\\SOFTWARE\\eHorusDispl\\.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#registryN/A1010N/AN/AN/AN/A
181*\System\CurrentControlSet\Services\ehorus*.{0,1000}\\System\\CurrentControlSet\\Services\\ehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#servicename #registryN/A1010N/AN/AN/AN/A
182*\System\CurrentControlSet\Services\EHORUSAGENT*.{0,1000}\\System\\CurrentControlSet\\Services\\EHORUSAGENT.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#servicename #registryN/A1010N/AN/AN/AN/A
183*>eHorus Agent Setup<*.{0,1000}\>eHorus\sAgent\sSetup\<.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#descriptionN/A1010N/AN/AN/AN/A
184*>EHORUSAGENT<*.{0,1000}\>EHORUSAGENT\<.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#servicenameN/A1010N/AN/AN/AN/A
185*https://portal.ehorus.com/#/agents/*.{0,1000}https\:\/\/portal\.ehorus\.com\/\#\/agents\/.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/11N/AN/A1010N/AN/AN/AN/A
186*hub.ehorus.com.{0,1000}hub\.ehorus\.comgreyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/11N/AN/A1010N/AN/AN/AN/A
187*sc delete ehorus*.{0,1000}sc\sdelete\sehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
188*sc stop ehorus*.{0,1000}sc\sstop\sehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
189*switch.ehorus.com*.{0,1000}switch\.ehorus\.com.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/11N/AN/A1010N/AN/AN/AN/A
190*taskkill /F /IM "ehorus_agent.exe"*.{0,1000}taskkill\s\/F\s\/IM\s\"ehorus_agent\.exe\".{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
191*taskkill /F /IM "ehorus_cmd.exe"*.{0,1000}taskkill\s\/F\s\/IM\s\"ehorus_cmd\.exe\".{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
192*/level-windows-amd64.exe*.{0,1000}\/level\-windows\-amd64\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/11N/AN/A1010N/AN/AN/AN/A
193*/level-windows-arm64.exe*.{0,1000}\/level\-windows\-arm64\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/11N/AN/A1010N/AN/AN/AN/A
194*taskkill /F /IM "ehorus_display.exe"*.{0,1000}taskkill\s\/F\s\/IM\s\"ehorus_display\.exe\".{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
195*umount /usr/share/ehorus/.gvfs -r >/dev/null 2>&1*.{0,1000}umount\s\/usr\/share\/ehorus\/\.gvfs\s\-r\s\>\/dev\/null\s2\>\&1.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
196*useradd -d /usr/share/ehorus -p * ehorus*.{0,1000}useradd\s\-d\s\/usr\/share\/ehorus\s\-p\s.{0,1000}\sehorus.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10N/AN/A1010N/AN/AN/AN/A
197*/Library/Logs/SPLog.txt*.{0,1000}\/Library\/Logs\/SPLog\.txt.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10N/AN/A1010N/AN/AN/AN/A
198*/LMI_Rescue.exe*.{0,1000}\/LMI_Rescue\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com11N/AN/A1010N/AN/AN/AN/A
199*/LMIRTechConsole.exe*.{0,1000}\/LMIRTechConsole\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com11N/AN/A1010N/AN/AN/AN/A
200*/log/anydesk.trace*.{0,1000}\/log\/anydesk\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
201*/MeshAgent --*.{0,1000}\/MeshAgent\s\-\-.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
202*/MeshAgent.git*.{0,1000}\/MeshAgent\.git.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent11N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
203*/MeshCentral.git*.{0,1000}\/MeshCentral\.git.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral11N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
204*/meshcentral.service*.{0,1000}\/meshcentral\.service.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
205*/meshinstall.sh*.{0,1000}\/meshinstall\.sh.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral11N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
206*/meshinstall-bsd-rcd.sh*.{0,1000}\/meshinstall\-bsd\-rcd\.sh.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral11N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
207*/nats-rmm.conf*.{0,1000}\/nats\-rmm\.conf.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
208*/nspowershell.exe*.{0,1000}\/nspowershell\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/11N/AN/A1010N/AN/AN/AN/A
209*/nssadmui.exe*.{0,1000}\/nssadmui\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/11N/AN/A1010N/AN/AN/AN/A
210*/pcictlui.exe*.{0,1000}\/pcictlui\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
211*/PCIDEPLY.exe*.{0,1000}\/PCIDEPLY\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
212*/PCMonitorManager.exe*.{0,1000}\/PCMonitorManager\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A
213*/PCMonitorSrv.exe*.{0,1000}\/PCMonitorSrv\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A
214*/pcmontask.exe*.{0,1000}\/pcmontask\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/11N/AN/A1010N/AN/AN/AN/A
215*/pcmrdp-client.dll*.{0,1000}\/pcmrdp\-client\.dll.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A
216*/pulseway_x64.deb*.{0,1000}\/pulseway_x64\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A
217*/Pulseway_x64.msi*.{0,1000}\/Pulseway_x64\.msi.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A
218*/pulseway_x86.deb*.{0,1000}\/pulseway_x86\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/11N/AN/A1010N/AN/AN/AN/A
219*/Quasar.git*.{0,1000}\/Quasar\.git.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar11N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
220*/Quasar.v*.zip*.{0,1000}\/Quasar\.v.{0,1000}\.zip.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar11N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
221*/Quasar/releases*.{0,1000}\/Quasar\/releases.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar11N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
222*/Quick Assist Installer.exe*.{0,1000}\/Quick\sAssist\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx511N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
223*/Quick%20Assist%20Installer.exe*.{0,1000}\/Quick\%20Assist\%20Installer\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx511N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
224*/Radmin.exe*.{0,1000}\/Radmin\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A
225*/Radmin_Server_*.msi*.{0,1000}\/Radmin_Server_.{0,1000}\.msi.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A
226*/Radmin_Viewer_*.msi*.{0,1000}\/Radmin_Viewer_.{0,1000}\.msi.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A
227*/Radmin_VPN_1.*.exe*.{0,1000}\/Radmin_VPN_1\..{0,1000}\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A
228*/RemoteControlSetup.exe*.{0,1000}\/RemoteControlSetup\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/11N/AN/A1010N/AN/AN/AN/A
229*/RemoteDesktop.exe*.{0,1000}\/RemoteDesktop\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/11N/AN/A1010N/AN/AN/AN/A
230*/remotepc.deb*.{0,1000}\/remotepc\.deb.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A
231*/remotepc.deb*.{0,1000}\/remotepc\.deb.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
232*/RemotePC.exe*.{0,1000}\/RemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A
233*/RemotePC.exe*.{0,1000}\/RemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
234*/RemotePC.lnk*.{0,1000}\/RemotePC\.lnk.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
235*/RemotePC.tmp*.{0,1000}\/RemotePC\.tmp.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
236*/remotepc-attended.deb*.{0,1000}\/remotepc\-attended\.deb.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A
237*/RemotePCAttended.dmg*.{0,1000}\/RemotePCAttended\.dmg.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A
238*/remotepclauncher.exe*.{0,1000}\/remotepclauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
239*/RemotePCSuite.dmg*.{0,1000}\/RemotePCSuite\.dmg.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A
240*/remotepcuiu.exe*.{0,1000}\/remotepcuiu\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
241*/RemotePCViewer.msi*.{0,1000}\/RemotePCViewer\.msi.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/11N/AN/A1010N/AN/AN/AN/A
242*/rfusclient.exe*.{0,1000}\/rfusclient\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A
243*/rmm/api/tacticalrmm/*.{0,1000}\/rmm\/api\/tacticalrmm\/.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
244*/rmm-installer.ps1*.{0,1000}\/rmm\-installer\.ps1.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
245*/RpcDND_Console.exe*.{0,1000}\/RpcDND_Console\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
246*/rpcdownloader.exe*.{0,1000}\/rpcdownloader\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
247*/RPCFireWallRule.exe*.{0,1000}\/RPCFireWallRule\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
248*/rpcperfviewer.exe*.{0,1000}\/rpcperfviewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
249*/RPCProxyLatency.exe*.{0,1000}\/RPCProxyLatency\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
250*/rserver3.exe*.{0,1000}\/rserver3\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/11N/AN/A1010N/AN/AN/AN/A
251*/RustDesk.exe*.{0,1000}\/RustDesk\.exe.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk11N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
252*/rustdesk.git*.{0,1000}\/rustdesk\.git.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk11N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
253*/rustdesk/rustdesk/releases/*.{0,1000}\/rustdesk\/rustdesk\/releases\/.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk11N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
254*/rutserv.exe*.{0,1000}\/rutserv\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A
255*/rutview.exe*.{0,1000}\/rutview\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A
256*$EHORUS_HOME/.vnc/passwd*.{0,1000}\$EHORUS_HOME\/\.vnc\/passwd.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A
257*/simplehelper64.exe*.{0,1000}\/simplehelper64\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com11N/AN/A1010N/AN/AN/AN/A
258*/SolarWinds-Dameware-DRS-St.exe*.{0,1000}\/SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software11N/ADameware Remote Support1010N/AN/AN/AN/A
259*/SplashtopStreamer/SPLog.txt*.{0,1000}\/SplashtopStreamer\/SPLog\.txt.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10N/AN/A1010N/AN/AN/AN/A
260*/Supremo.exe*.{0,1000}\/Supremo\.exe.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com11N/AN/A1010N/AN/AN/AN/A
261*/system/chrome-remote-desktop@*.{0,1000}\/system\/chrome\-remote\-desktop\@.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
262*/system/meshagent*.{0,1000}\/system\/meshagent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
263*/system/MeshCommander*.{0,1000}\/system\/MeshCommander.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
264*/systemd/system/pulseway.service*.{0,1000}\/systemd\/system\/pulseway\.service.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
265*/tacticalagent.log*.{0,1000}\/tacticalagent\.log.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
266*/tacticalagent-v*-*.exe*.{0,1000}\/tacticalagent\-v.{0,1000}\-.{0,1000}\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
267*/tacticalagent-v*-linux-arm.exe*.{0,1000}\/tacticalagent\-v.{0,1000}\-linux\-arm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
268*/tacticalagent-v*-windows-amd64.exe*.{0,1000}\/tacticalagent\-v.{0,1000}\-windows\-amd64\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
269*/tacticalrmm.exe*.{0,1000}\/tacticalrmm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
270*/tacticalrmm.git*.{0,1000}\/tacticalrmm\.git.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
271*/tacticalrmm/master/install.sh*.{0,1000}\/tacticalrmm\/master\/install\.sh.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
272*/tacticalrmm/releases/latest*.{0,1000}\/tacticalrmm\/releases\/latest.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
273*/tacticalrmm-web.git*.{0,1000}\/tacticalrmm\-web\.git.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm11N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
274*/tightvnc-*.msi*.{0,1000}\/tightvnc\-.{0,1000}\.msi.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com11N/AN/A1010N/AN/AN/AN/A
275*/tkc_agent_dre.deb*.{0,1000}\/tkc_agent_dre\.deb.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software11N/AN/A1010N/AN/AN/AN/A
276*/tmp/*/enroll.sh*.{0,1000}\/tmp\/.{0,1000}\/enroll\.sh.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
277*/tmp/*/itsm.service*.{0,1000}\/tmp\/.{0,1000}\/itsm\.service.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
278*/tmp/*/itsm-linux*.{0,1000}\/tmp\/.{0,1000}\/itsm\-linux.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
279*/tmp/fleet_remove_log.txt*.{0,1000}\/tmp\/fleet_remove_log\.txt.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
280*/usr/bin/anydesk*.{0,1000}\/usr\/bin\/anydesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#linuxrisk of false positives - compliance detection1010N/AN/AN/AN/A
281*/usr/bin/ehorus_agent*.{0,1000}\/usr\/bin\/ehorus_agent.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#linuxN/A1010N/AN/AN/AN/A
282*/usr/bin/r-agent*.{0,1000}\/usr\/bin\/r\-agent.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#linuxlinux1010N/AN/AN/AN/A
283*/usr/bin/r-viewer*.{0,1000}\/usr\/bin\/r\-viewer.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#linuxlinux1010N/AN/AN/AN/A
284*/usr/lib64/anydesk*.{0,1000}\/usr\/lib64\/anydesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
285*/usr/libexec/anydesk*.{0,1000}\/usr\/libexec\/anydesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
286*/usr/local/bin/level*.{0,1000}\/usr\/local\/bin\/level.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A
287*/usr/sbin/pulseway*.{0,1000}\/usr\/sbin\/pulseway.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
288*/usr/sbin/pulsewayd*.{0,1000}\/usr\/sbin\/pulsewayd.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
289*/usr/share/applications/r-agent.desktop*.{0,1000}\/usr\/share\/applications\/r\-agent\.desktop.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/Alinux1010N/AN/AN/AN/A
290*/usr/share/applications/r-viewer.desktop*.{0,1000}\/usr\/share\/applications\/r\-viewer\.desktop.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/Alinux1010N/AN/AN/AN/A
291*/var/lib/level/level.db*.{0,1000}\/var\/lib\/level\/level\.db.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A
292*/var/lib/level/level.log*.{0,1000}\/var\/lib\/level\/level\.log.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10#linuxN/A1010N/AN/AN/AN/A
293*/var/log/ehorus_agent.log*.{0,1000}\/var\/log\/ehorus_agent\.log.{0,1000}greyware_tool_keywordEHORUS RMMPandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlacksuit - RoyalRMMhttps://pandorafms.com/en/remote-control/10#logfile #linuxN/A1010N/AN/AN/AN/A
294*/viewerhostkeypopup.exe*.{0,1000}\/viewerhostkeypopup\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/11N/AN/A1010N/AN/AN/AN/A
295*/VPDAgent.exe*.{0,1000}\/VPDAgent\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/11N/AN/A1010N/AN/AN/AN/A
296*/VSAX_x64.msi*.{0,1000}\/VSAX_x64\.msi.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/11N/AN/A1010N/AN/AN/AN/A
297*/vsxrc-clip.exe*.{0,1000}\/vsxrc\-clip\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/11N/AN/A1010N/AN/AN/AN/A
298*/Win7Taskbar.dll*.{0,1000}\/Win7Taskbar\.dll.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/11N/AN/A1010N/AN/AN/AN/A
299*/ZA_Connect.exe*.{0,1000}\/ZA_Connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A
300*/ZAAudioClient.exe*.{0,1000}\/ZAAudioClient\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A
301*/ZAFileTransfer.exe*.{0,1000}\/ZAFileTransfer\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A
302*/ZAService.exe*.{0,1000}\/ZAService\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/11N/AN/A1010N/AN/AN/AN/A
303*:8040/SetupWizard.aspx*.{0,1000}\:8040\/SetupWizard\.aspx.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download11N/AN/A1010N/AN/AN/AN/A
304*:9001/proxy/mdmserver1/account*.{0,1000}\:9001\/proxy\/mdmserver1\/account.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet11N/AN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
305*\*-*-*_rut-*.zip.3bf*[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}_rut-[0-9]\.[0-9]\.[0-9]\.[0-9]\.zip\.3bfgreyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
306*\*-internet-id-log.csv*.{0,1000}\\.{0,1000}\-internet\-id\-log\.csv.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
307*\.dwagent\*.{0,1000}\\\.dwagent\\.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
308*\.rustdesk*.{0,1000}\\\.rustdesk.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
309*\\.\pipe\orbit-osquery-extension*.{0,1000}\\\\\.\\pipe\\orbit\-osquery\-extension.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10#namedpipeN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
310*\\.\pipe\Supremo*.{0,1000}\\\\\.\\pipe\\Supremo.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#namedpipeN/A1010N/AN/AN/AN/A
311*\\MeshAgent*.{0,1000}\\\\MeshAgent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
312*\\RustDeskIddDriver*.{0,1000}\\\\RustDeskIddDriver.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
313*\127.0.0.1-5900.vnc*.{0,1000}\\127\.0\.0\.1\-5900\.vnc.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
314*\aa_nts.dll*.{0,1000}\\aa_nts\.dll.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A
315*\AA_v3.exe*.{0,1000}\\AA_v3\.exe.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A
316*\AA_v3.log*.{0,1000}\\AA_v3\.log.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A
317*\Action1\7z.dll*.{0,1000}\\Action1\\7z\.dll.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A
318*\Action1\Agent\Certificate*.{0,1000}\\Action1\\Agent\\Certificate.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A
319*\Action1\CrashDumps*.{0,1000}\\Action1\\CrashDumps.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A
320*\Action1\package_downloads*.{0,1000}\\Action1\\package_downloads.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A
321*\Action1\scripts\Run_PowerShell_*.{0,1000}\\Action1\\scripts\\Run_PowerShell_.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A
322*\action1_agent(My_Organization).msi*.{0,1000}\\action1_agent\(My_Organization\)\.msi.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/11N/Aproduct name1010N/AN/AN/AN/A
323*\ACTION1_AGENT.EXE-*.{0,1000}\\ACTION1_AGENT\.EXE\-.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A
324*\action1_log_*.log*.{0,1000}\\action1_log_.{0,1000}\.log.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/Aexample C:\Windows\Action1\logs\action1_log_2023-12-17_13-42-47~10328.log1010N/AN/AN/AN/A
325*\ad_svc.trace*.{0,1000}\\ad_svc\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.inversecos.com/2021/02/forensic-analysis-of-anydesk-logs.html10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
326*\ADM Templates\ADMX\*.admx*.{0,1000}\\ADM\sTemplates\\ADMX\\.{0,1000}\.admx.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
327*\adprinterpipe*.{0,1000}\\adprinterpipe.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
328*\Advanced Monitoring Agent\debug.log*.{0,1000}\\Advanced\sMonitoring\sAgent\\debug\.log.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A
329*\Advanced Monitoring Agent\staging*.{0,1000}\\Advanced\sMonitoring\sAgent\\staging.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A
330*\Advanced Monitoring Agent\task_start.js*.{0,1000}\\Advanced\sMonitoring\sAgent\\task_start\.js.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A
331*\Advanced Monitoring Agent\unzip.exe*.{0,1000}\\Advanced\sMonitoring\sAgent\\unzip\.exe.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A
332*\Advanced Monitoring Agent\winagent.exe*.{0,1000}\\Advanced\sMonitoring\sAgent\\winagent\.exe.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A
333*\AeroAdmin *_Portable.exe*.{0,1000}\\AeroAdmin\s.{0,1000}_Portable\.exe.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A
334*\aeroadmin.exe*.{0,1000}\\aeroadmin\.exe.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A
335*\Aeroadmin.lnk*.{0,1000}\\Aeroadmin\.lnk.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A
336*\Aeroadmin\black.bmp*.{0,1000}\\Aeroadmin\\black\.bmp.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A
337*\Alpemix.ini*.{0,1000}\\Alpemix\.ini.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A
338*\Alpemix.zip*.{0,1000}\\Alpemix\.zip.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A
339*\AlphaControlAgent\obj\Release\AteraAgent.pdb*.{0,1000}\\AlphaControlAgent\\obj\\Release\\AteraAgent\.pdb.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
340*\AMMYY\access.log*.{0,1000}\\AMMYY\\access\.log.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A
341*\AnyDesk (1).exe*.{0,1000}\\AnyDesk\s\(1\)\.exe.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
342*\AnyDesk.exe*.{0,1000}\\AnyDesk\.exe.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
343*\AnyDesk.lnk*.{0,1000}\\AnyDesk\.lnk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
344*\AnyDesk\ad.trace*.{0,1000}\\AnyDesk\\ad\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
345*\AnyDesk\ad_svc.trace*.{0,1000}\\AnyDesk\\ad_svc\.trace.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
346*\AnyDesk\connection_trace.txt*.{0,1000}\\AnyDesk\\connection_trace\.txt.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
347*\AnyDesk\connection_trace.txt*.{0,1000}\\AnyDesk\\connection_trace\.txt.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
348*\anydesk\printer_driver*.{0,1000}\\anydesk\\printer_driver.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
349*\AnyDesk\service.conf*.{0,1000}\\AnyDesk\\service\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
350*\AnyDeskPrintDriver.cat*.{0,1000}\\AnyDeskPrintDriver\.cat.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
351*\anydeskprintdriver.inf*.{0,1000}\\anydeskprintdriver\.inf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
352*\Anyplace Control - Admin.lnk*.{0,1000}\\Anyplace\sControl\s\-\sAdmin\.lnk.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A
353*\Anyplace Control\*.{0,1000}\\Anyplace\sControl\\.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A
354*\anyplace-control.ini*.{0,1000}\\anyplace\-control\.ini.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A
355*\AnyViewerSetup.exe*.{0,1000}\\AnyViewerSetup\.exe.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A
356*\AnyViewerSetup.tmp*.{0,1000}\\AnyViewerSetup\.tmp.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A
357*\Apemix.exe*.{0,1000}\\Apemix\.exe.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A
358*\AppData\Local\*\rescue.log*.{0,1000}\\AppData\\Local\\.{0,1000}\\rescue\.log.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
359*\appdata\local\bomgar\bomgar-rep\*.{0,1000}\\appdata\\local\\bomgar\\bomgar\-rep\\.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
360*\appdata\local\damewa~1\*.{0,1000}\\appdata\\local\\damewa\~1\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
361*\appdata\local\dameware remote everywhere*.{0,1000}\\appdata\\local\\dameware\sremote\severywhere.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
362*\AppData\Local\Downloaded Installations\*\server-3.3.5.0.msi*.{0,1000}\\AppData\\Local\\Downloaded\sInstallations\\.{0,1000}\\server\-3\.3\.5\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
363*\AppData\Local\Downloaded Installations\*\viewer-7.2.2.0.msi*.{0,1000}\\AppData\\Local\\Downloaded\sInstallations\\.{0,1000}\\viewer\-7\.2\.2\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
364*\AppData\Local\GoToMyPC\*.{0,1000}\\AppData\\Local\\GoToMyPC\\.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
365*\AppData\Local\LMIR*.tmp.bat*.{0,1000}\\AppData\\Local\\LMIR.{0,1000}\.tmp\.bat.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
366*\AppData\Local\LogMeIn Rescue Applet\*.{0,1000}\\AppData\\Local\\LogMeIn\sRescue\sApplet\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
367*\appdata\local\microsoft\windows\inetcache\ie\can_install_pc[1].xml*.{0,1000}\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\can_install_pc\[1\]\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
368*\AppData\Local\rustdesk\*.{0,1000}\\AppData\\Local\\rustdesk\\.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
369*\AppData\Local\Temp\*\gosetup.exe*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\gosetup\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
370*\AppData\Local\Temp\*\GoToOpener.msi*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\GoToOpener\.msi.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
371*\AppData\Local\Temp\*\NSM.LIC*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\NSM\.LIC.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
372*\AppData\Local\Temp\*\server-3.3.5.0.exe*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\server\-3\.3\.5\.0\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
373*\AppData\Local\Temp\*\server-3.3.5.0.msi*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\server\-3\.3\.5\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
374*\AppData\Local\Temp\*\zmstage.exe*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\zmstage\.exe.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A
375*\AppData\Local\Temp\*_Radmin_3.*.zip*.{0,1000}\\AppData\\Local\\Temp\\.{0,1000}_Radmin_3\..{0,1000}\.zip.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
376*\AppData\Local\Temp\dwagent*.{0,1000}\\AppData\\Local\\Temp\\dwagent.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
377*\AppData\Local\Temp\ITarian_Remote_Access_*.{0,1000}\\AppData\\Local\\Temp\\ITarian_Remote_Access_.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
378*\AppData\Local\Temp\Remote_Control_by_Itarian*.{0,1000}\\AppData\\Local\\Temp\\Remote_Control_by_Itarian.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
379*\AppData\Local\Temp\RemoteHelp\EBWebView*.{0,1000}\\AppData\\Local\\Temp\\RemoteHelp\\EBWebView.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
380*\AppData\Local\Temp\rutserv*.{0,1000}\\AppData\\Local\\Temp\\rutserv.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
381*\AppData\Local\ZohoMeeting\*.{0,1000}\\AppData\\Local\\ZohoMeeting\\.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
382*\AppData\LocalLow\LogMeIn Rescue\*.{0,1000}\\AppData\\LocalLow\\LogMeIn\sRescue\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
383*\AppData\Roaming\*\remote.nsm*.{0,1000}\\AppData\\Roaming\\.{0,1000}\\remote\.nsm.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
384*\AppData\Roaming\*\RemoteDesktop.exe*.{0,1000}\\AppData\\Roaming\\.{0,1000}\\RemoteDesktop\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
385*\AppData\Roaming\*\uac.tmp.{0,1000}\\AppData\\Roaming\\.{0,1000}\\uac\.tmpgreyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
386*\AppData\Roaming\*-5900.vnc*.{0,1000}\\AppData\\Roaming\\.{0,1000}\-5900\.vnc.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
387*\appdata\roaming\*'DestPort'>4782</Data>*.{0,1000}\\appdata\\roaming\\.{0,1000}\'DestPort\'\>4782\<\/Data\>.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
388*\AppData\Roaming\AnyDesk\system.conf*.{0,1000}\\AppData\\Roaming\\AnyDesk\\system\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
389*\AppData\Roaming\AnyDesk\user.conf*.{0,1000}\\AppData\\Roaming\\AnyDesk\\user\.conf.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
390*\AppData\Roaming\Anyplace Control*.{0,1000}\\AppData\\Roaming\\Anyplace\sControl.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A
391*\AppData\Roaming\DameWare Development\*.{0,1000}\\AppData\\Roaming\\DameWare\sDevelopment\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
392*\AppData\Roaming\freerdp*.{0,1000}\\AppData\\Roaming\\freerdp.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
393*\AppData\Roaming\NetSupport\*.{0,1000}\\AppData\\Roaming\\NetSupport\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
394*\AppData\Roaming\Radmin*.{0,1000}\\AppData\\Roaming\\Radmin.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
395*\AppData\Roaming\Remote Utilities Files*.{0,1000}\\AppData\\Roaming\\Remote\sUtilities\sFiles.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
396*\AppData\Roaming\TeamViewer*.{0,1000}\\AppData\\Roaming\\TeamViewer.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
397*\AppData\Roaming\UltraVNC\*.{0,1000}\\AppData\\Roaming\\UltraVNC\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
398*\AppData\Roaming\VSA X*.{0,1000}\\AppData\\Roaming\\VSA\sX.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
399*\Assistance rapide Installer.exe*.{0,1000}\\Assistance\srapide\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
400*\Assistenza rapida Installer.exe*.{0,1000}\\Assistenza\srapida\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
401*\atera_agent.exe*.{0,1000}\\atera_agent\.exe.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
402*\AttendedServiceRemove.exe*.{0,1000}\\AttendedServiceRemove\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
403*\AttendedUDP.zip*.{0,1000}\\AttendedUDP\.zip.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
404*\Aweray Remote.lnk*.{0,1000}\\Aweray\sRemote\.lnk.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
405*\Aweray_Remote_*.exe*.{0,1000}\\Aweray_Remote_.{0,1000}\.exe.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
406*\Aweray_Remote_*.zip*.{0,1000}\\Aweray_Remote_.{0,1000}\.zip.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
407*\AweSun.exe*.{0,1000}\\AweSun\.exe.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
408*\baconsoleapp.exe*.{0,1000}\\baconsoleapp\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
409*\baconsoleappen.dll*.{0,1000}\\baconsoleappen\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
410*\baseclient.exe* -consoleinstallcomplete*.{0,1000}\\baseclient\.exe.{0,1000}\s\-consoleinstallcomplete.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
411*\basupclphlp.exe*.{0,1000}\\basupclphlp\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
412*\basupclpprg.exe*.{0,1000}\\basupclpprg\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
413*\basupconhelper.exe*.{0,1000}\\basupconhelper\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
414*\basuplib.dll*.{0,1000}\\basuplib\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
415*\basupportexpresssrvcupdater_dameware*.{0,1000}\\basupportexpresssrvcupdater_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
416*\basupportexpressstandaloneservice_dameware*.{0,1000}\\basupportexpressstandaloneservice_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
417*\basupregedithlpr.exe*.{0,1000}\\basupregedithlpr\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
418*\basupregedithlpr_*.log*.{0,1000}\\basupregedithlpr_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
419*\basupsrvc.cfg*.{0,1000}\\basupsrvc\.cfg.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
420*\basupsrvc.exe*.{0,1000}\\basupsrvc\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
421*\basupsrvc.ico*.{0,1000}\\basupsrvc\.ico.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
422*\basupsrvc.ini*.{0,1000}\\basupsrvc\.ini.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
423*\basupsrvc.xml*.{0,1000}\\basupsrvc\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
424*\basupsrvc_*.log*.{0,1000}\\basupsrvc_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
425*\basupsrvccnfg.exe*.{0,1000}\\basupsrvccnfg\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
426*\basupsrvccnfg_*.log*.{0,1000}\\basupsrvccnfg_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
427*\basupsrvccnfg_dameware*.{0,1000}\\basupsrvccnfg_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
428*\basupsrvccnfgde.dll*.{0,1000}\\basupsrvccnfgde\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
429*\basupsrvccnfgen.dll*.{0,1000}\\basupsrvccnfgen\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
430*\basupsrvccnfges.dll*.{0,1000}\\basupsrvccnfges\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
431*\basupsrvccnfgfr.dll*.{0,1000}\\basupsrvccnfgfr\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
432*\basupsrvccnfgit.dll*.{0,1000}\\basupsrvccnfgit\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
433*\basupsrvccnfgpt.dll*.{0,1000}\\basupsrvccnfgpt\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
434*\basupsrvcde.dll*.{0,1000}\\basupsrvcde\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
435*\basupsrvcen.dll*.{0,1000}\\basupsrvcen\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
436*\basupsrvces.dll*.{0,1000}\\basupsrvces\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
437*\basupsrvcevnt3.dll*.{0,1000}\\basupsrvcevnt3\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
438*\basupsrvcfr.dll*.{0,1000}\\basupsrvcfr\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
439*\basupsrvcit.dll*.{0,1000}\\basupsrvcit\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
440*\basupsrvcpt.dll*.{0,1000}\\basupsrvcpt\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
441*\basupsrvcupdater.exe*.{0,1000}\\basupsrvcupdater\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
442*\basupsrvcupdater_*.log*.{0,1000}\\basupsrvcupdater_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
443*\basupsysinf*.log*.{0,1000}\\basupsysinf.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
444*\basupsysinf.exe*.{0,1000}\\basupsysinf\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
445*\basupsysinf.ini*.{0,1000}\\basupsysinf\.ini.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
446*\basupsysshell.exe*.{0,1000}\\basupsysshell\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
447*\basupsysshell64.exe*.{0,1000}\\basupsysshell64\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
448*\basuptshelper.exe*.{0,1000}\\basuptshelper\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
449*\basuptshelper_*.log*.{0,1000}\\basuptshelper_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
450*\basuptshelperlib.dll*.{0,1000}\\basuptshelperlib\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
451*\basupunelev.exe*.{0,1000}\\basupunelev\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
452*\basupvista.dll*.{0,1000}\\basupvista\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
453*\bavideochat.exe*.{0,1000}\\bavideochat\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
454*\bawhook.dll*.{0,1000}\\bawhook\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
455*\beanywhere support express service - [dameware]*.{0,1000}\\beanywhere\ssupport\sexpress\sservice\s\-\s\[dameware\].{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
456*\Bomgar-enum_cp-*.{0,1000}\\Bomgar\-enum_cp\-.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
457*\bomgar-rep.cache\*.{0,1000}\\bomgar\-rep\.cache\\.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
458*\bomgar-rep.exe*.{0,1000}\\bomgar\-rep\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
459*\bomgar-rep-installer.exe*.{0,1000}\\bomgar\-rep\-installer\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
460*\bomgar-scc-*.exe*.{0,1000}\\bomgar\-scc\-.{0,1000}\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
461*\bomgar-scc.exe*.{0,1000}\\bomgar\-scc\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
462*\BOMGAR-SCC.EXE-*.{0,1000}\\BOMGAR\-SCC\.EXE\-.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
463*\BRMM_2024.1-Release*.{0,1000}\\BRMM_2024\.1\-Release.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
464*\BSUtility.exe*.{0,1000}\\BSUtility\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
465*\cbhook-x86.dll*.{0,1000}\\cbhook\-x86\.dll.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
466*\Chrome Remote Desktop\host.json*.{0,1000}\\Chrome\sRemote\sDesktop\\host\.json.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
467*\Citrix\GoToMyPc\FileTransfer\history*.{0,1000}\\Citrix\\GoToMyPc\\FileTransfer\\history.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
468*\Citrix\GoToMyPc\GuestInvite*.{0,1000}\\Citrix\\GoToMyPc\\GuestInvite.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
469*\ComodoRemoteControl.exe*.{0,1000}\\ComodoRemoteControl\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
470*\config\RustDesk.toml*.{0,1000}\\config\\RustDesk\.toml.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
471*\config\RustDesk_local.*.{0,1000}\\config\\RustDesk_local\..{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
472*\Control\Print\Monitors\REMOTEPCPRINTER*.{0,1000}\\Control\\Print\\Monitors\\REMOTEPCPRINTER.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A
473*\Control\SafeBoot\Network\SupremoService*.{0,1000}\\Control\\SafeBoot\\Network\\SupremoService.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#registryregistry1010N/AN/AN/AN/A
474*\ControlSet001\Control\SafeBoot\Network\AmmyyAdmin_*.{0,1000}\\ControlSet001\\Control\\SafeBoot\\Network\\AmmyyAdmin_.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10#registryN/A1010N/AN/AN/AN/A
475*\ControlSet001\Services\AnyDesk*.{0,1000}\\ControlSet001\\Services\\AnyDesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
476*\createpassword.exe*.{0,1000}\\createpassword\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
477*\CurrentControlSet\Control\SafeBoot\Network\AeroadminService*.{0,1000}\\CurrentControlSet\\Control\\SafeBoot\\Network\\AeroadminService.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10#registryN/A1010N/AN/AN/AN/A
478*\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (*.{0,1000}\\CurrentControlSet\\Control\\SafeBoot\\Network\\ScreenConnect\sClient\s\(.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10#registryN/A1010N/AN/AN/AN/A
479*\CurrentControlSet\Services\AeroadminService*.{0,1000}\\CurrentControlSet\\Services\\AeroadminService.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10#registryN/A1010N/AN/AN/AN/A
480*\CurrentControlSet\Services\AlpemixSrvcx*.{0,1000}\\CurrentControlSet\\Services\\AlpemixSrvcx.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10#registryN/A1010N/AN/AN/AN/A
481*\CurrentControlSet\Services\bam\State\UserSettings\*\MicrosoftCorporationII.QuickAssist_*.{0,1000}\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\.{0,1000}\\MicrosoftCorporationII\.QuickAssist_.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510#registryQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
482*\CurrentControlSet\Services\ItsmRsp*.{0,1000}\\CurrentControlSet\\Services\\ItsmRsp.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#servicename #registryN/A1010N/AN/AN/AN/A
483*\CurrentControlSet\Services\ITSMService*.{0,1000}\\CurrentControlSet\\Services\\ITSMService.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#servicename #registryN/A1010N/AN/AN/AN/A
484*\CurrentControlSet\Services\Mesh*.{0,1000}\\CurrentControlSet\\Services\\Mesh.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10#registryN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
485*\CurrentControlSet\Services\MiniInternetIdService*.{0,1000}\\CurrentControlSet\\Services\\MiniInternetIdService.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A
486*\CurrentControlSet\Services\RmmService*.{0,1000}\\CurrentControlSet\\Services\\RmmService.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#servicename #registryN/A1010N/AN/AN/AN/A
487*\CurrentControlSet\Services\ScreenConnect *.{0,1000}\\CurrentControlSet\\Services\\ScreenConnect\s.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10#registryN/A1010N/AN/AN/AN/A
488*\CurrentControlSet\Services\SupremoService*.{0,1000}\\CurrentControlSet\\Services\\SupremoService.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#servicename #registryregistry1010N/AN/AN/AN/A
489*\CurrentControlSet\Services\TeamViewer*.{0,1000}\\CurrentControlSet\\Services\\TeamViewer.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10#servicename #registryFP risk - teamviewer usage1010N/AN/AN/AN/A
490*\CurrentControlSet\Services\VSAX*.{0,1000}\\CurrentControlSet\\Services\\VSAX.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#servicename #registryregistry1010N/AN/AN/AN/A
491*\CurrentControlSet\Services\Zoho Assist-Remote Support*.{0,1000}\\CurrentControlSet\\Services\\Zoho\sAssist\-Remote\sSupport.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10#servicename #registryN/A1010N/AN/AN/AN/A
492*\CurrentVersion\App Paths\RemotePCPerformance*.{0,1000}\\CurrentVersion\\App\sPaths\\RemotePCPerformance.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A
493*\CurrentVersion\Devices\Remote Utilities Printer*.{0,1000}\\CurrentVersion\\Devices\\Remote\sUtilities\sPrinter.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A
494*\CurrentVersion\Devices\RemotePC Printer*.{0,1000}\\CurrentVersion\\Devices\\RemotePC\sPrinter.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A
495*\CurrentVersion\Run\Bomgar Support Reconnect*.{0,1000}\\CurrentVersion\\Run\\Bomgar\sSupport\sReconnect.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
496*\CurrentVersion\Run\DWAgentMon*.{0,1000}\\CurrentVersion\\Run\\DWAgentMon.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
497*\CurrentVersion\Run\Quasar Client Startup*.{0,1000}\\CurrentVersion\\Run\\Quasar\sClient\sStartup.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
498*\currentversion\uninstall\dameware remote everywhere*.{0,1000}\\currentversion\\uninstall\\dameware\sremote\severywhere.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
499*\CurrentVersion\Uninstall\Representative Console [eval-*.{0,1000}\\CurrentVersion\\Uninstall\\Representative\sConsole\s\[eval\-.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
500*\CurrentVersion\Uninstall\RustDesk*.{0,1000}\\CurrentVersion\\Uninstall\\RustDesk.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
501*\CurrentVersion\Uninstall\Ultravnc2_is1\*.{0,1000}\\CurrentVersion\\Uninstall\\Ultravnc2_is1\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A
502*\DameWare Development\MrcVerbLog*.{0,1000}\\DameWare\sDevelopment\\MrcVerbLog.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
503*\Dameware Mini Remote Control x64\*.{0,1000}\\Dameware\sMini\sRemote\sControl\sx64\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
504*\dameware mini remote control x64\*.{0,1000}\\dameware\smini\sremote\scontrol\sx64\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
505*\DameWare Mini Remote Control*.exe*.{0,1000}\\DameWare\sMini\sRemote\sControl.{0,1000}\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
506*\Dameware Mini Remote Control.lnk*.{0,1000}\\Dameware\sMini\sRemote\sControl\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
507*\dameware remote everywhere agent*.{0,1000}\\dameware\sremote\severywhere\sagent.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
508*\dameware remote everywhere.lnk*.{0,1000}\\dameware\sremote\severywhere\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
509*\Dameware Remote Support .lnk*.{0,1000}\\Dameware\sRemote\sSupport\s\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
510*\Dameware Remote Support\*.{0,1000}\\Dameware\sRemote\sSupport\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
511*\DameWare.Diagnostics*.{0,1000}\\DameWare\.Diagnostics.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
512*\DameWare.LogAdjuster.exe*.{0,1000}\\DameWare\.LogAdjuster\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
513*\DameWare.LogAdjuster.exe.config*.{0,1000}\\DameWare\.LogAdjuster\.exe\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
514*\damewareagent.exe.{0,1000}\\damewareagent\.exegreyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
515*\damewareagent.exe*.{0,1000}\\damewareagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
516*\damewareremoteeverywhere\*.{0,1000}\\damewareremoteeverywhere\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
517*\damewareremoteeverywhereagentinstaller.install.log*.{0,1000}\\damewareremoteeverywhereagentinstaller\.install\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
518*\dctoolshardware.exe*.{0,1000}\\dctoolshardware\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
519*\disable dameware remote everywhere agent.lnk*.{0,1000}\\disable\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
520*\DMRC-10-Evaluation.lic*.{0,1000}\\DMRC\-10\-Evaluation\.lic.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
521*\DNTU.exe*.{0,1000}\\DNTU\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
522*\Documents\ConnectWiseControl\Files*.{0,1000}\\Documents\\ConnectWiseControl\\Files.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
523*\dre_mac_console.zip*.{0,1000}\\dre_mac_console\.zip.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
524*\drivers\x64\rupdui.dll*.{0,1000}\\drivers\\x64\\rupdui\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
525*\dwagent.exe*.{0,1000}\\dwagent\.exe.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
526*\DWAgent.lnk*.{0,1000}\\DWAgent\.lnk.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
527*\dwagent.log*.{0,1000}\\dwagent\.log.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
528*\dwagent.pid*.{0,1000}\\dwagent\.pid.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
529*\dwagent.start*.{0,1000}\\dwagent\.start.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
530*\dwagent.stop*.{0,1000}\\dwagent\.stop.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
531*\dwaggdi.dll*.{0,1000}\\dwaggdi\.dll.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
532*\dwaginstall.log*.{0,1000}\\dwaginstall\.log.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
533*\dwaglnc.exe*.{0,1000}\\dwaglnc\.exe.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
534*\dwagsvc.exe*.{0,1000}\\dwagsvc\.exe.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
535*\dwagupd.dll*.{0,1000}\\dwagupd\.dll.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
536*\DWAMTD.dll*.{0,1000}\\DWAMTD\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
537*\DWAMTDRES.dll*.{0,1000}\\DWAMTDRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
538*\DWMRC_St_64.msi*.{0,1000}\\DWMRC_St_64\.msi.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
539*\DWMSISET.W32*.{0,1000}\\DWMSISET\.W32.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
540*\DWMSISET.X64*.{0,1000}\\DWMSISET\.X64.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
541*\DWNativeWCFClient.dll*.{0,1000}\\DWNativeWCFClient\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
542*\DWNativeWCFClientRES.dll*.{0,1000}\\DWNativeWCFClientRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
543*\DWPing.dll*.{0,1000}\\DWPing\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
544*\DWPINGRES.dll*.{0,1000}\\DWPINGRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
545*\DWRCBA.dll*.{0,1000}\\DWRCBA\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
546*\DWRCBN.dll*.{0,1000}\\DWRCBN\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
547*\DWRCC.chm*.{0,1000}\\DWRCC\.chm.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
548*\DWRCC.exe*.{0,1000}\\DWRCC\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
549*\DWRCC.log*.{0,1000}\\DWRCC\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
550*\DWRCC.log*.{0,1000}\\DWRCC\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
551*\DWRCC.Logging.xml*.{0,1000}\\DWRCC\.Logging\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
552*\DWRCCH.dll*.{0,1000}\\DWRCCH\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
553*\DWRCChat.dll*.{0,1000}\\DWRCChat\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
554*\DWRCChatRES.dll*.{0,1000}\\DWRCChatRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
555*\DWRCCMD.exe*.{0,1000}\\DWRCCMD\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
556*\DWRCCRES.dll*.{0,1000}\\DWRCCRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
557*\DWRCCSFTv2.data*.{0,1000}\\DWRCCSFTv2\.data.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
558*\DWRCD.dll*.{0,1000}\\DWRCD\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
559*\DWRCD.dll*.{0,1000}\\DWRCD\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
560*\DWRCK.dll*.{0,1000}\\DWRCK\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
561*\DWRCOP.dll*.{0,1000}\\DWRCOP\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
562*\DWRCOPRES.dll*.{0,1000}\\DWRCOPRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
563*\DWRCPN.dll*.{0,1000}\\DWRCPN\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
564*\DWRCRSA.dll*.{0,1000}\\DWRCRSA\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
565*\DWRCRSS.dll*.{0,1000}\\DWRCRSS\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
566*\DWRCRSS.dll*.{0,1000}\\DWRCRSS\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
567*\DWRCS.exe*.{0,1000}\\DWRCS\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
568*\DWRCS.Logging.xml*.{0,1000}\\DWRCS\.Logging\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
569*\DWRCS.reg*.{0,1000}\\DWRCS\.reg.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
570*\DWRCSET.dll*.{0,1000}\\DWRCSET\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
571*\DWRCSETRES.dll*.{0,1000}\\DWRCSETRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
572*\DWRCSh.dll*.{0,1000}\\DWRCSh\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
573*\DWRCSHRegister.cmd*.{0,1000}\\DWRCSHRegister\.cmd.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
574*\DWRCSI.dll*.{0,1000}\\DWRCSI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
575*\DWRCSI.dll*.{0,1000}\\DWRCSI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
576*\DWRCSIRES.dll*.{0,1000}\\DWRCSIRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
577*\DWRCSMSI.exe*.{0,1000}\\DWRCSMSI\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
578*\DWRCSMSIRES.dll*.{0,1000}\\DWRCSMSIRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
579*\DWRCSPC.exe*.{0,1000}\\DWRCSPC\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
580*\DWRCSPCRES.dll*.{0,1000}\\DWRCSPCRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
581*\DWRCSPX.exe*.{0,1000}\\DWRCSPX\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
582*\DWRCSPXRES.dll*.{0,1000}\\DWRCSPXRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
583*\DWRCSRES.dll*.{0,1000}\\DWRCSRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
584*\DWRCST.exe*.{0,1000}\\DWRCST\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
585*\DWRCST.Logging.xml*.{0,1000}\\DWRCST\.Logging\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
586*\DWRCSTRES.dll*.{0,1000}\\DWRCSTRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
587*\DWRCU3.dll*.{0,1000}\\DWRCU3\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
588*\DWRCWHD.Logging.xml*.{0,1000}\\DWRCWHD\.Logging\.xml.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
589*\DWRCWHDAPI.dll*.{0,1000}\\DWRCWHDAPI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
590*\DWRCWHDUI.dll*.{0,1000}\\DWRCWHDUI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
591*\DWRCWHDUIRES.dll*.{0,1000}\\DWRCWHDUIRES\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
592*\DWRCWol.dll*.{0,1000}\\DWRCWol\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
593*\DWRCWXL.dll*.{0,1000}\\DWRCWXL\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
594*\DWRTD.dll*.{0,1000}\\DWRTD\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
595*\DWRTDE.exe*.{0,1000}\\DWRTDE\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
596*\DWRTDR.dll*.{0,1000}\\DWRTDR\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
597*\DWRTDR.dll*.{0,1000}\\DWRTDR\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
598*\DWSGRWRP.dll*.{0,1000}\\DWSGRWRP\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
599*\DWUtil.dll*.{0,1000}\\DWUtil\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
600*\DWWFDS.dll*.{0,1000}\\DWWFDS\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
601*\embedhook-x64.exe*.{0,1000}\\embedhook\-x64\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
602*\embedhook-x86.exe*.{0,1000}\\embedhook\-x86\.exe.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
603*\enable dameware remote everywhere agent.lnk*.{0,1000}\\enable\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
604*\eventlog\application\dameware *.{0,1000}\\eventlog\\application\\dameware\s.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
605*\file_transfer_trace.txt*.{0,1000}\\file_transfer_trace\.txt.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://upadhyayraj.medium.com/beyond-connection-logs-understanding-file-transfer-artifacts-in-anydesk-forensics-b5812c817aad10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
606*\g2comm.exe*.{0,1000}\\g2comm\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
607*\g2fileh.exe*.{0,1000}\\g2fileh\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
608*\g2host.exe*.{0,1000}\\g2host\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
609*\g2mainh.exe*.{0,1000}\\g2mainh\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
610*\g2printh.exe*.{0,1000}\\g2printh\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
611*\g2svc.exe*.{0,1000}\\g2svc\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
612*\getsupportservice_common_dameware*.{0,1000}\\getsupportservice_common_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
613*\getsupportservice_dameware*.{0,1000}\\getsupportservice_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
614*\getsupportservice_dameware\*.{0,1000}\\getsupportservice_dameware\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
615*\goLoader.exe*.{0,1000}\\goLoader\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
616*\Google\Chrome Remote Desktop\*.{0,1000}\\Google\\Chrome\sRemote\sDesktop\\.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
617*\gosetup[1].exe*.{0,1000}\\gosetup\[1\]\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
618*\GoTo Opener.exe*.{0,1000}\\GoTo\sOpener\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
619*\GoTo\Logs\goto.log*.{0,1000}\\GoTo\\Logs\\goto\.log.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
620*\gotomon.dll*.{0,1000}\\gotomon\.dll.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
621*\gotomon_x64.dll*.{0,1000}\\gotomon_x64\.dll.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
622*\GoToMyPC.cab*.{0,1000}\\GoToMyPC\.cab.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
623*\GoToMyPC\*\*\g2ldr.log*.{0,1000}\\GoToMyPC\\.{0,1000}\\.{0,1000}\\g2ldr\.log.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
624*\gotomypc\g2pre.exe*.{0,1000}\\gotomypc\\g2pre\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
625*\GoToMyPC\g2svc.exe*.{0,1000}\\GoToMyPC\\g2svc\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
626*\gotomypc_3944.exe*.{0,1000}\\gotomypc_3944\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
627*\GoToMyPCCrashHandler.exe*.{0,1000}\\GoToMyPCCrashHandler\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
628*\GoToOpener.log*.{0,1000}\\GoToOpener\.log.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
629*\GoToOpener[1].msi*.{0,1000}\\GoToOpener\[1\]\.msi.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
630*\HiddenDesktop.h*.{0,1000}\\HiddenDesktop\.h.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054231262022-02-14T02:31:56Z2021-09-03T17:34:44Z
631*\host-7.2.2.0.msi*.{0,1000}\\host\-7\.2\.2\.0\.msi.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
632*\hvnc.exe*.{0,1000}\\hvnc\.exe.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054231262022-02-14T02:31:56Z2021-09-03T17:34:44Z
633*\HVNC.sln*.{0,1000}\\HVNC\.sln.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054231262022-02-14T02:31:56Z2021-09-03T17:34:44Z
634*\HVNC.vcxproj*.{0,1000}\\HVNC\.vcxproj.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054231262022-02-14T02:31:56Z2021-09-03T17:34:44Z
635*\HVNC-main.zip*.{0,1000}\\HVNC\-main\.zip.{0,1000}offensive_tool_keywordHVNCStandalone HVNC Client & Server Coded in C++ (Modified Tinynuke)T1021.005 - T1071 - T1563.002 - T1219TA0001 - TA0002 - TA0008N/AN/ARMMhttps://github.com/Meltedd/HVNC10N/AN/A1054231262022-02-14T02:31:56Z2021-09-03T17:34:44Z
636*\ICON_ID_GOTOMYPC*.{0,1000}\\ICON_ID_GOTOMYPC.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
637*\InternetIdService.exe*.{0,1000}\\InternetIdService\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
638*\InternetIdService_*-*-*.txt.{0,1000}\\InternetIdService_.{0,1000}\-.{0,1000}\-.{0,1000}\.txtgreyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
639*\InventoryApplicationFile\aeroadmin*.{0,1000}\\InventoryApplicationFile\\aeroadmin.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AN/A1010N/AN/AN/AN/A
640*\InventoryApplicationFile\rpcattendedadmin*.{0,1000}\\InventoryApplicationFile\\rpcattendedadmin.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
641*\InventoryApplicationFile\screenconnect.cl*.{0,1000}\\InventoryApplicationFile\\screenconnect\.cl.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
642*\InventoryApplicationFile\screenconnect.wi*.{0,1000}\\InventoryApplicationFile\\screenconnect\.wi.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
643*\InventoryApplicationFile\tacticalagent-v2*.{0,1000}\\InventoryApplicationFile\\tacticalagent\-v2.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10#registryregistry101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
644*\InventoryApplicationFile\ultravnc_*.{0,1000}\\InventoryApplicationFile\\ultravnc_.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A
645*\InventoryApplicationFile\zaservice.exe*.{0,1000}\\InventoryApplicationFile\\zaservice\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
646*\ITarian Remote Access.lnk*.{0,1000}\\ITarian\sRemote\sAccess\.lnk.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
647*\itarian\endpoint manager\itsmagent.exe*.{0,1000}\\itarian\\endpoint\smanager\\itsmagent\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
648*\itarian\endpoint manager\itsmservice.exe*.{0,1000}\\itarian\\endpoint\smanager\\itsmservice\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
649*\itarian\endpoint manager\rhost.exe*.{0,1000}\\itarian\\endpoint\smanager\\rhost\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
650*\ITarian\RemoteControl*.{0,1000}\\ITarian\\RemoteControl.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
651*\ITarian_Remote_Access_*.log*.{0,1000}\\ITarian_Remote_Access_.{0,1000}\.log.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
652*\ITarianRemoteAccess.exe*.{0,1000}\\ITarianRemoteAccess\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
653*\JWrapper-SimpleHelp Remote Work*.{0,1000}\\JWrapper\-SimpleHelp\sRemote\sWork.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
654*\JWrapper-SimpleHelp Technician*.{0,1000}\\JWrapper\-SimpleHelp\sTechnician.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
655*\JWrapper-SimpleHelp Technician\*.{0,1000}\\JWrapper\-SimpleHelp\sTechnician\\.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
656*\Kaseya\PC Monitor\*.{0,1000}\\Kaseya\\PC\sMonitor\\.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A
657*\level.exe*--check-service*.{0,1000}\\level\.exe.{0,1000}\-\-check\-service.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
658*\level-remote-control-ffmpeg.exe.download*.{0,1000}\\level\-remote\-control\-ffmpeg\.exe\.download.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
659*\level-windows-amd64.exe*.{0,1000}\\level\-windows\-amd64\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
660*\level-windows-arm64.exe*.{0,1000}\\level\-windows\-arm64\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
661*\librustdesk.dll*.{0,1000}\\librustdesk\.dll.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
662*\linuxconsole_dw (1).zip*.{0,1000}\\linuxconsole_dw\s\(1\)\.zip.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
663*\LMI_Rescue.exe*.{0,1000}\\LMI_Rescue\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
664*\lmi_rescue_srv.exe*.{0,1000}\\lmi_rescue_srv\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
665*\LMIGuardianEvt.dll*.{0,1000}\\LMIGuardianEvt\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
666*\LMIR*.tmp\rarcc.dll*.{0,1000}\\LMIR.{0,1000}\.tmp\\rarcc\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
667*\LMIRescue-*.clog*.{0,1000}\\LMIRescue\-.{0,1000}\.clog.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
668*\LMIRescue-*.connlog*.{0,1000}\\LMIRescue\-.{0,1000}\.connlog.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
669*\LMIRescueCOL.log*.{0,1000}\\LMIRescueCOL\.log.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
670*\LMIRescueMqttMessages_*.dat*.{0,1000}\\LMIRescueMqttMessages_.{0,1000}\.dat.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
671*\LMIRescueUpdater.log*.{0,1000}\\LMIRescueUpdater\.log.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
672*\LMIRhook.000.dll*.{0,1000}\\LMIRhook\.000\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
673*\lmirtechconsole.exe*.{0,1000}\\lmirtechconsole\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
674*\LMIRTechConsole.exe*.{0,1000}\\LMIRTechConsole\.exe.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
675*\LMITrs-*.trs*.{0,1000}\\LMITrs\-.{0,1000}\.trs.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
676*\Local\Temp\LogMeInLogs\GoToOpenerMsi\*.{0,1000}\\Local\\Temp\\LogMeInLogs\\GoToOpenerMsi\\.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
677*\log\FileTransferWindowAppLog.log*.{0,1000}\\log\\FileTransferWindowAppLog\.log.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
678*\LogMeIn Rescue Applet\LMIR*.{0,1000}\\LogMeIn\sRescue\sApplet\\LMIR.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
679*\LogMeIn Rescue Applet\LMIR*.{0,1000}\\LogMeIn\sRescue\sApplet\\LMIR.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
680*\LogMeIn Rescue AVI Codec\*.{0,1000}\\LogMeIn\sRescue\sAVI\sCodec\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
681*\logmein rescue technician console\*.{0,1000}\\logmein\srescue\stechnician\sconsole\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
682*\LogMeIn\Dumps\*.{0,1000}\\LogMeIn\\Dumps\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
683*\LogMeInLogs\GoToOpenerMsi*.{0,1000}\\LogMeInLogs\\GoToOpenerMsi.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
684*\LogMeInRescue_ipc*.{0,1000}\\LogMeInRescue_ipc.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/Apipename1010N/AN/AN/AN/A
685*\LogMeInRescue_rarc_r_*.{0,1000}\\LogMeInRescue_rarc_r_.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/Apipename1010N/AN/AN/AN/A
686*\LogMeInRescue_rarc_w_*.{0,1000}\\LogMeInRescue_rarc_w_.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/Apipename1010N/AN/AN/AN/A
687*\LogMeInRescueTechnicianConsole_x64*.{0,1000}\\LogMeInRescueTechnicianConsole_x64.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
688*\logs\baseclient_*.log*.{0,1000}\\logs\\baseclient_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
689*\logs\baseconsoleapp_*.log*.{0,1000}\\logs\\baseconsoleapp_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
690*\logs\basupclphlp_*.log*.{0,1000}\\logs\\basupclphlp_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
691*\Logs\DNTU.log*.{0,1000}\\Logs\\DNTU\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
692*\logs\RCService.txt*.{0,1000}\\logs\\RCService\.txt.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A
693*\Logs\rut_log_*.html*.{0,1000}\\Logs\\rut_log_.{0,1000}\.html.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
694*\meshagent.db*.{0,1000}\\meshagent\.db.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
695*\MeshAgent.sln*.{0,1000}\\MeshAgent\.sln.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
696*\MeshAgentKvm.log*.{0,1000}\\MeshAgentKvm\.log.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
697*\MeshAgent-master*.{0,1000}\\MeshAgent\-master.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
698*\meshcentral.db*.{0,1000}\\meshcentral\.db.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
699*\meshcentral.js*.{0,1000}\\meshcentral\.js.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
700*\MeshCentral.sln*.{0,1000}\\MeshCentral\.sln.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
701*\MeshCentral\*.{0,1000}\\MeshCentral\\.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
702*\MeshCmd.exe*.{0,1000}\\MeshCmd\.exe.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
703*\meshcmd.js*.{0,1000}\\meshcmd\.js.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
704*\meshcommander.dmp*.{0,1000}\\meshcommander\.dmp.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
705*\MeshMessenger.exe*.{0,1000}\\MeshMessenger\.exe.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
706*\MeshService.rc*.{0,1000}\\MeshService\.rc.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
707*\Microsoft.RemoteAssistance.QuickAssist\*.{0,1000}\\Microsoft\.RemoteAssistance\.QuickAssist\\.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
708*\microsoft.remoteassistance.quickassist\*.{0,1000}\\microsoft\.remoteassistance\.quickassist\\.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
709*\Mini Remote Control Client Agent MSI Builder.lnk*.{0,1000}\\Mini\sRemote\sControl\sClient\sAgent\sMSI\sBuilder\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
710*\Mini Remote Control Diagnostics.lnk*.{0,1000}\\Mini\sRemote\sControl\sDiagnostics\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
711*\Mini Remote Control Help.lnk*.{0,1000}\\Mini\sRemote\sControl\sHelp\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
712*\Mini Remote Control Log Adjuster.lnk*.{0,1000}\\Mini\sRemote\sControl\sLog\sAdjuster\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
713*\Mini Remote Control Service*.{0,1000}\\Mini\sRemote\sControl\sService.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
714*\Mini Remote Control Service\Settings\SFT: Upload Folder*.{0,1000}\\Mini\sRemote\sControl\sService\\Settings\\SFT\:\sUpload\sFolder.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
715*\Mini Remote Control.lnk*.{0,1000}\\Mini\sRemote\sControl\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
716*\mlnhcpkomdeavomsjalt*.{0,1000}\\mlnhcpkomdeavomsjalt.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/Anamed pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L21010N/AN/AN/AN/A
717*\MMSOFT Design\PC Monitor*.{0,1000}\\MMSOFT\sDesign\\PC\sMonitor.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A
718*\MMSOFT Design\Pulseway\*.{0,1000}\\MMSOFT\sDesign\\Pulseway\\.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A
719*\MRC_12.0_Bootstrap_Install_Log.txt*.{0,1000}\\MRC_12\.0_Bootstrap_Install_Log\.txt.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
720*\MRCCv2.db*.{0,1000}\\MRCCv2\.db.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
721*\mspacredentialprovider_*_dameware.dll*.{0,1000}\\mspacredentialprovider_.{0,1000}_dameware\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
722*\msparegedithelper_*.{0,1000}\\msparegedithelper_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
723*\mspxtshlpsrv_*.{0,1000}\\mspxtshlpsrv_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
724*\mspxwebcom.dll*.{0,1000}\\mspxwebcom\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
725*\multiplicar negocios\beanywhere support express*.{0,1000}\\multiplicar\snegocios\\beanywhere\ssupport\sexpress.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
726*\MWDiagnosticCollector.exe*.{0,1000}\\MWDiagnosticCollector\.exe.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
727*\MWDiagnosticCollectorResult_*.zip*.{0,1000}\\MWDiagnosticCollectorResult_.{0,1000}\.zip.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
728*\NETSUP~1\PCIShellExt64.dll*.{0,1000}\\NETSUP\~1\\PCIShellExt64\.dll.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
729*\NetSupport Ltd\Client32*.{0,1000}\\NetSupport\sLtd\\Client32.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A
730*\NetSupport Ltd\PCICTL*.{0,1000}\\NetSupport\sLtd\\PCICTL.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A
731*\netsupport manager\*.{0,1000}\\netsupport\smanager\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
732*\NetSupport School Console*.{0,1000}\\NetSupport\sSchool\sConsole.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
733*\NetSupport School\*.{0,1000}\\NetSupport\sSchool\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
734*\NetSupport School\NetSupport*.{0,1000}\\NetSupport\sSchool\\NetSupport.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
735*\node_modules\meshcentral*.{0,1000}\\node_modules\\meshcentral.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
736*\novaPDF11OEM(x64).msi*.{0,1000}\\novaPDF11OEM\(x64\)\.msi.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
737*\nspowershell.exe*.{0,1000}\\nspowershell\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
738*\nssadmui.exe*.{0,1000}\\nssadmui\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
739*\Open Source\MeshCentral\*.{0,1000}\\Open\sSource\\MeshCentral\\.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
740*\options.vnc*.{0,1000}\\options\.vnc.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A
741*\PC Monitor\Addons*.{0,1000}\\PC\sMonitor\\Addons.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A
742*\pcicfgui_client.exe*.{0,1000}\\pcicfgui_client\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
743*\pciconn.exe*.{0,1000}\\pciconn\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
744*\PCICTL\ConfigList\Standard\UI\*.{0,1000}\\PCICTL\\ConfigList\\Standard\\UI\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A
745*\pcictlui.exe*.{0,1000}\\pcictlui\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
746*\PCIDEPLY.exe*.{0,1000}\\PCIDEPLY\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
747*\PCINSSCD.exe*.{0,1000}\\PCINSSCD\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
748*\PCINSSUI.exe*.{0,1000}\\PCINSSUI\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
749*\PCISCRUI.exe*.{0,1000}\\PCISCRUI\.exe.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
750*\PCIShellExt64.dll*.{0,1000}\\PCIShellExt64\.dll.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
751*\PCMonitorManager.exe*.{0,1000}\\PCMonitorManager\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
752*\PCMonitorSrv.exe*.{0,1000}\\PCMonitorSrv\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
753*\PCMonitorTypes.dll*.{0,1000}\\PCMonitorTypes\.dll.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
754*\pcmontask.exe*.{0,1000}\\pcmontask\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
755*\pcmrdp-client.dll*.{0,1000}\\pcmrdp\-client\.dll.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
756*\pcmupdate.exe*.{0,1000}\\pcmupdate\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
757*\pcmupdate.exe*.{0,1000}\\pcmupdate\.exe.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
758*\pcmupdate.exe.config*.{0,1000}\\pcmupdate\.exe\.config.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
759*\Pictures\AnyDesk*.{0,1000}\\Pictures\\AnyDesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
760*\pipe\chrome_remote_desktop*.{0,1000}\\pipe\\chrome_remote_desktop.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10#namedpipeN/A1010N/AN/AN/AN/A
761*\Prefetch\ANYDESK.EXE*.{0,1000}\\Prefetch\\ANYDESK\.EXE.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
762*\prefetch\baconsoleapp.exe*.{0,1000}\\prefetch\\baconsoleapp\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
763*\prefetch\baseclient.exe*.{0,1000}\\prefetch\\baseclient\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
764*\prefetch\basupclphlp.exe*.{0,1000}\\prefetch\\basupclphlp\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
765*\prefetch\basupregedithlpr.exe*.{0,1000}\\prefetch\\basupregedithlpr\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
766*\prefetch\basupsrvc.exe*.{0,1000}\\prefetch\\basupsrvc\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
767*\prefetch\basupsrvccnfg.exe*.{0,1000}\\prefetch\\basupsrvccnfg\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
768*\prefetch\basupsrvcupdater.exe*.{0,1000}\\prefetch\\basupsrvcupdater\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
769*\prefetch\basupsysinf.exe*.{0,1000}\\prefetch\\basupsysinf\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
770*\prefetch\basuptshelper.exe*.{0,1000}\\prefetch\\basuptshelper\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
771*\prefetch\damewareagent.exe*.{0,1000}\\prefetch\\damewareagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
772*\prefetch\damewareremoteeverywhereconso*.{0,1000}\\prefetch\\damewareremoteeverywhereconso.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
773*\Prefetch\QUASAR.EXE*.{0,1000}\\Prefetch\\QUASAR\.EXE.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
774*\prefetch\tcrmtshellagent.exe*.{0,1000}\\prefetch\\tcrmtshellagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
775*\prefetch\tcrmtshellviewer.exe*.{0,1000}\\prefetch\\tcrmtshellviewer\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
776*\prefetch\tkcuploader.exe*.{0,1000}\\prefetch\\tkcuploader\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
777*\Print\Printers\RemotePC Printer\*.{0,1000}\\Print\\Printers\\RemotePC\sPrinter\\.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A
778*\Printers\Remote Utilities Printer\*.{0,1000}\\Printers\\Remote\sUtilities\sPrinter\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A
779*\progra~2\damewa~1\remoteshell\*.{0,1000}\\progra\~2\\damewa\~1\\remoteshell\\.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
780*\Program Files (x86)\Advanced Monitoring Agent\*.{0,1000}\\Program\sFiles\s\(x86\)\\Advanced\sMonitoring\sAgent\\.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A
781*\Program Files (x86)\Anyplace Control*.{0,1000}\\Program\sFiles\s\(x86\)\\Anyplace\sControl.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A
782*\Program Files (x86)\Atera Networks*.{0,1000}\\Program\sFiles\s\(x86\)\\Atera\sNetworks.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
783*\Program Files (x86)\Barracuda RMM\*.{0,1000}\\Program\sFiles\s\(x86\)\\Barracuda\sRMM\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
784*\program files (x86)\gotomypc\g2tray.exe*.{0,1000}\\program\sfiles\s\(x86\)\\gotomypc\\g2tray\.exe.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
785*\Program Files (x86)\ITarian\Endpoint Manager\*.{0,1000}\\Program\sFiles\s\(x86\)\\ITarian\\Endpoint\sManager\\.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
786*\Program Files (x86)\ITarian\RemoteControl\*.{0,1000}\\Program\sFiles\s\(x86\)\\ITarian\\RemoteControl\\.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
787*\Program Files (x86)\Level Platforms\*.{0,1000}\\Program\sFiles\s\(x86\)\\Level\sPlatforms\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
788*\Program Files (x86)\Level\*.{0,1000}\\Program\sFiles\s\(x86\)\\Level\\.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
789*\Program Files (x86)\RemotePC\*.{0,1000}\\Program\sFiles\s\(x86\)\\RemotePC\\.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
790*\program files (x86)\remotepc\remotepcperformance\*.{0,1000}\\program\sfiles\s\(x86\)\\remotepc\\remotepcperformance\\.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
791*\Program Files\Advanced Monitoring Agent\*.{0,1000}\\Program\sFiles\\Advanced\sMonitoring\sAgent\\.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A
792*\Program Files\Atera Networks*.{0,1000}\\Program\sFiles\\Atera\sNetworks.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
793*\Program Files\Aweray*.{0,1000}\\Program\sFiles\\Aweray.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
794*\Program Files\Barracuda RMM\*.{0,1000}\\Program\sFiles\\Barracuda\sRMM\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
795*\Program Files\Level Platforms\*.{0,1000}\\Program\sFiles\\Level\sPlatforms\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
796*\Program Files\Level\level.db*.{0,1000}\\Program\sFiles\\Level\\level\.db.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
797*\Program Files\Level\osqueryi.exe*.{0,1000}\\Program\sFiles\\Level\\osqueryi\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
798*\Program Files\Level\winpty.dll*.{0,1000}\\Program\sFiles\\Level\\winpty\.dll.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
799*\Program Files\Level\winpty-agent.exe*.{0,1000}\\Program\sFiles\\Level\\winpty\-agent\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
800*\Program Files\SubDir\Client.exe*.{0,1000}\\Program\sFiles\\SubDir\\Client\.exe.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
801*\Program Files\Supremo\*.{0,1000}\\Program\sFiles\\Supremo\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
802*\Program Files\TacticalAgent\*.{0,1000}\\Program\sFiles\\TacticalAgent\\.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
803*\Program Files\TeamViewer*.{0,1000}\\Program\sFiles\\TeamViewer.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
804*\ProgramData\Aeroadmin\*.{0,1000}\\ProgramData\\Aeroadmin\\.{0,1000}greyware_tool_keywordaeroadminRMM software - full remote control / file transferT1021.001 - T1048.003TA0008 - TA0011 - TA0009 - TA0010N/AN/ARMMhttps://ulm.aeroadmin.com/AeroAdmin.exe10N/AC:\ProgramData\Aeroadmin\log.json1010N/AN/AN/AN/A
805*\ProgramData\AMMYY\*.{0,1000}\\ProgramData\\AMMYY\\.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10N/AN/A1010N/AN/AN/AN/A
806*\ProgramData\Anyplace Control *.{0,1000}\\ProgramData\\Anyplace\sControl\s.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A
807*\ProgramData\Barracuda MSP\*.{0,1000}\\ProgramData\\Barracuda\sMSP\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
808*\programdata\bomgar-scc-*.{0,1000}\\programdata\\bomgar\-scc\-.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
809*\ProgramData\LogMeIn\*.{0,1000}\\ProgramData\\LogMeIn\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
810*\ProgramData\Remote Utilities*.{0,1000}\\ProgramData\\Remote\sUtilities.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
811*\ProgramData\RemotePC*.{0,1000}\\ProgramData\\RemotePC.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
812*\ProgramData\RustDesk\*.{0,1000}\\ProgramData\\RustDesk\\.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
813*\ProgramData\SupremoRemoteDesktop*.{0,1000}\\ProgramData\\SupremoRemoteDesktop.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
814*\ProgramData\TacticalRMM\*.{0,1000}\\ProgramData\\TacticalRMM\\.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
815*\ProgramFile*\previous-version.{0,1000}\\ProgramFile.{0,40}\\previous-versiongreyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Aold anydesk version after update1010N/AN/AN/AN/A
816*\Programs\GoToMyPC.lnk*.{0,1000}\\Programs\\GoToMyPC\.lnk.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
817*\Programs\SimpleHelp Remote Work"*.{0,1000}\\Programs\\SimpleHelp\sRemote\sWork\".{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A
818*\Programs\SimpleHelp Technician*.{0,1000}\\Programs\\SimpleHelp\sTechnician.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A
819*\Programs\TightVNC*.{0,1000}\\Programs\\TightVNC.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/AN/A1010N/AN/AN/AN/A
820*\Pulseway Remote Control\*.{0,1000}\\Pulseway\sRemote\sControl\\.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
821*\Pulseway\*.{0,1000}\\Pulseway\\.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
822*\pulseway_x64.deb*.{0,1000}\\pulseway_x64\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
823*\Pulseway_x64.msi*.{0,1000}\\Pulseway_x64\.msi.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
824*\pulseway_x86.deb*.{0,1000}\\pulseway_x86\.deb.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
825*\PulsewayServiceCheck*.{0,1000}\\PulsewayServiceCheck.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A
826*\pwyrc-agent.dll*.{0,1000}\\pwyrc\-agent\.dll.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
827*\pwy-rd\shell\open\command*.{0,1000}\\pwy\-rd\\shell\\open\\command.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A
828*\Quasar.Client\*.{0,1000}\\Quasar\.Client\\.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
829*\Quasar.Common\*.cs*.{0,1000}\\Quasar\.Common\\.{0,1000}\.cs.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
830*\quasar.p12*.{0,1000}\\quasar\.p12.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
831*\Quasar.v*.zip*.{0,1000}\\Quasar\.v.{0,1000}\.zip.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
832*\Quasar-master*.{0,1000}\\Quasar\-master.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
833*\Quick Assist Installer.exe*.{0,1000}\\Quick\sAssist\sInstaller\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
834*\quick launch\dameware remote everywhere tech console.lnk*.{0,1000}\\quick\slaunch\\dameware\sremote\severywhere\stech\sconsole\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
835*\QuickAssist.exe*.{0,1000}\\QuickAssist\.exe.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
836*\QuickAssist.pdb*.{0,1000}\\QuickAssist\.pdb.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
837*\ractrlkeyhook.dll*.{0,1000}\\ractrlkeyhook\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
838*\Radmin.exe*.{0,1000}\\Radmin\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
839*\RADMIN.EXE-*.pf*.{0,1000}\\RADMIN\.EXE\-.{0,1000}\.pf.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
840*\Radmin\radmin.rpb*.{0,1000}\\Radmin\\radmin\.rpb.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
841*\Radmin_Server_*.msi*.{0,1000}\\Radmin_Server_.{0,1000}\.msi.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
842*\Radmin_Viewer_*.msi*.{0,1000}\\Radmin_Viewer_.{0,1000}\.msi.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
843*\Radmin_VPN_1.*.exe*.{0,1000}\\Radmin_VPN_1\..{0,1000}\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
844*\remote access session.exe*.{0,1000}\\remote\saccess\ssession\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
845*\remote access.exe*.{0,1000}\\remote\saccess\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
846*\Remote AccessEmbedExample.html*.{0,1000}\\Remote\sAccessEmbedExample\.html.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
847*\Remote Access-java-online.jar*.{0,1000}\\Remote\sAccess\-java\-online\.jar.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
848*\remote support.exe*.{0,1000}\\remote\ssupport\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
849*\Remote SupportEmbedExample.html*.{0,1000}\\Remote\sSupportEmbedExample\.html.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
850*\remote utilities - host\*.{0,1000}\\remote\sutilities\s\-\shost\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
851*\Remote Utilities - Host\*.{0,1000}\\Remote\sUtilities\s\-\sHost\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
852*\remote utilities agent\*.{0,1000}\\remote\sutilities\sagent\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
853*\Remote Utilities Agent\Logs*.{0,1000}\\Remote\sUtilities\sAgent\\Logs.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
854*\Remote Utilities Files\rdp_connections\*.{0,1000}\\Remote\sUtilities\sFiles\\rdp_connections\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
855*\Remote Utilities Server\*.{0,1000}\\Remote\sUtilities\sServer\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
856*\Remote Utilities\Logs*.{0,1000}\\Remote\sUtilities\\Logs.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
857*\Remote Utilities\MiniInternetId*.{0,1000}\\Remote\sUtilities\\MiniInternetId.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A
858*\remote_assistance_host.exe*.{0,1000}\\remote_assistance_host\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
859*\Remote_Control_by_ITarian_*.log*.{0,1000}\\Remote_Control_by_ITarian_.{0,1000}\.log.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
860*\remoteaccess-jar-with-dependencies.jar*.{0,1000}\\remoteaccess\-jar\-with\-dependencies\.jar.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
861*\remotecontrol\rcontrol.exe*.{0,1000}\\remotecontrol\\rcontrol\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
862*\remotecontrol\rviewer.exe*.{0,1000}\\remotecontrol\\rviewer\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
863*\RemoteControlbyITarian (3).exe*.{0,1000}\\RemoteControlbyITarian\s\(3\)\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
864*\RemoteControlbyITarian_(3).exe*.{0,1000}\\RemoteControlbyITarian_\(3\)\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
865*\RemoteControlSetup.exe*.{0,1000}\\RemoteControlSetup\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
866*\RemoteDesktop.exe*.{0,1000}\\RemoteDesktop\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
867*\RemoteDesktop_x64.msi*.{0,1000}\\RemoteDesktop_x64\.msi.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
868*\RemotePC (1).exe*.{0,1000}\\RemotePC\s\(1\)\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
869*\RemotePC Attended.lnk*.{0,1000}\\RemotePC\sAttended\.lnk.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
870*\RemotePC Attended\*.{0,1000}\\RemotePC\sAttended\\.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
871*\RemotePC Performance Host\*.{0,1000}\\RemotePC\sPerformance\sHost\\.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
872*\RemotePC.Common.dll*.{0,1000}\\RemotePC\.Common\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
873*\RemotePC.exe*.{0,1000}\\RemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
874*\RemotePC.exe*.{0,1000}\\RemotePC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
875*\RemotePC.lnk*.{0,1000}\\RemotePC\.lnk.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
876*\RemotePC.tmp*.{0,1000}\\RemotePC\.tmp.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
877*\RemotePC.tmp*.{0,1000}\\RemotePC\.tmp.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
878*\RemotePC\*.dll*.{0,1000}\\RemotePC\\.{0,1000}\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
879*\RemotePCAttended.dmg*.{0,1000}\\RemotePCAttended\.dmg.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
880*\RemotePCCopyPaste.txt*.{0,1000}\\RemotePCCopyPaste\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
881*\RemotePCDDriver.cat*.{0,1000}\\RemotePCDDriver\.cat.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
882*\RemotePCDDriver.inf*.{0,1000}\\RemotePCDDriver\.inf.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
883*\RemotePCDDriverumode1_0.dll*.{0,1000}\\RemotePCDDriverumode1_0\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
884*\RemotePCDDriverumode1_2.dll*.{0,1000}\\RemotePCDDriverumode1_2\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
885*\RemotePCDesktop.txt*.{0,1000}\\RemotePCDesktop\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
886*\RemotePCDnD.dll*.{0,1000}\\RemotePCDnD\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
887*\RemotePCDnDLauncher.exe*.{0,1000}\\RemotePCDnDLauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
888*\RemotePCHDDesktop.txt*.{0,1000}\\RemotePCHDDesktop\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
889*\RemotePCHDService.txt*.{0,1000}\\RemotePCHDService\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
890*\remotepclauncher.exe*.{0,1000}\\remotepclauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
891*\RemotePCModules.log*.{0,1000}\\RemotePCModules\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
892*\RemotePCPDF.conf*.{0,1000}\\RemotePCPDF\.conf.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
893*\RemotePCPerformancePlugins.exe*.{0,1000}\\RemotePCPerformancePlugins\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
894*\RemotePCPrinter.exe*.{0,1000}\\RemotePCPrinter\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
895*\RemotePCPrinter.exe.config*.{0,1000}\\RemotePCPrinter\.exe\.config.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
896*\RemotePCPrinter.pdb*.{0,1000}\\RemotePCPrinter\.pdb.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
897*\RemotePCPrinterCore.dll*.{0,1000}\\RemotePCPrinterCore\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
898*\RemotePCPrinterCore.pdb*.{0,1000}\\RemotePCPrinterCore\.pdb.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
899*\RemotePCProxys.dat*.{0,1000}\\RemotePCProxys\.dat.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
900*\RemotePCPS5UI.DLL*.{0,1000}\\RemotePCPS5UI\.DLL.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
901*\RemotePCPS5UI.DLL*.{0,1000}\\RemotePCPS5UI\.DLL.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
902*\RemotePCPSCRIPT.*.{0,1000}\\RemotePCPSCRIPT\..{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
903*\RemotePCPSCRIPT.HLP*.{0,1000}\\RemotePCPSCRIPT\.HLP.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
904*\RemotePCPSCRIPT.NTF*.{0,1000}\\RemotePCPSCRIPT\.NTF.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
905*\RemotePCPSCRIPT5.DLL*.{0,1000}\\RemotePCPSCRIPT5\.DLL.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
906*\RemotePCService.exe*.{0,1000}\\RemotePCService\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
907*\RemotePCService.txt*.{0,1000}\\RemotePCService\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
908*\RemotePCService_2.txt*.{0,1000}\\RemotePCService_2\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
909*\RemotePCSuite.dmg*.{0,1000}\\RemotePCSuite\.dmg.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
910*\RemotePCUDE.cat*.{0,1000}\\RemotePCUDE\.cat.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
911*\RemotePCUDE.inf*.{0,1000}\\RemotePCUDE\.inf.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
912*\RemotePCUDE.sys*.{0,1000}\\RemotePCUDE\.sys.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
913*\RemotePCUDEHost.cat*.{0,1000}\\RemotePCUDEHost\.cat.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
914*\RemotePCUDEHost.inf*.{0,1000}\\RemotePCUDEHost\.inf.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
915*\RemotePCUDEHost.sys*.{0,1000}\\RemotePCUDEHost\.sys.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
916*\RemotePCUIA.exe*.{0,1000}\\RemotePCUIA\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
917*\RemotePCUIU.exe*.{0,1000}\\RemotePCUIU\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
918*\remotepcuiu.exe*.{0,1000}\\remotepcuiu\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
919*\RemotePCViewer.msi*.{0,1000}\\RemotePCViewer\.msi.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
920*\RemoteSupport\127.0.0.1.tvc*.{0,1000}\\RemoteSupport\\127\.0\.0\.1\.tvc.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
921*\remoting_desktop.exe*.{0,1000}\\remoting_desktop\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
922*\remoting_host.exe*.{0,1000}\\remoting_host\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
923*\remoting_native_messaging_host.exe*.{0,1000}\\remoting_native_messaging_host\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
924*\remoting_start_host.exe*.{0,1000}\\remoting_start_host\.exe.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/AN/A1010N/AN/AN/AN/A
925*\RescueWinRTLib.dll*.{0,1000}\\RescueWinRTLib\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
926*\RescueWinRTLib.dll*.{0,1000}\\RescueWinRTLib\.dll.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
927*\rfusclient.exe*.{0,1000}\\rfusclient\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
928*\rmm-client-site-server.exe*.{0,1000}\\rmm\-client\-site\-server\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
929*\rmm-client-site-server.exe*.{0,1000}\\rmm\-client\-site\-server\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
930*\rmm-installer.ps1*.{0,1000}\\rmm\-installer\.ps1.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
931*\RmmService.exe*.{0,1000}\\RmmService\.exe.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10N/AN/A1010N/AN/AN/AN/A
932*\Root\InventoryApplicationFile\support-logmeinr*.{0,1000}\\Root\\InventoryApplicationFile\\support\-logmeinr.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
933*\Root\InventoryApplicationFile\za_connect.exe*.{0,1000}\\Root\\InventoryApplicationFile\\za_connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
934*\RpcAccessPermissionNotifier.exe*.{0,1000}\\RpcAccessPermissionNotifier\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
935*\RpcApp\RPCCodecEngine.exe*.{0,1000}\\RpcApp\\RPCCodecEngine\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
936*\RpcApp\Tools\Chat.exe*.{0,1000}\\RpcApp\\Tools\\Chat\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
937*\RpcApp\Tools\TransferServer.exe*.{0,1000}\\RpcApp\\Tools\\TransferServer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
938*\RPCAppLauncherLogFile.txt*.{0,1000}\\RPCAppLauncherLogFile\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
939*\RPCAttended.log*.{0,1000}\\RPCAttended\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
940*\RPCAttendedAdmin.exe*.{0,1000}\\RPCAttendedAdmin\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
941*\RPCCertificate.log*.{0,1000}\\RPCCertificate\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
942*\RPCClipboard.exe*.{0,1000}\\RPCClipboard\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
943*\RPCClipboardAttended.exe*.{0,1000}\\RPCClipboardAttended\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
944*\RPCConfig.ini*.{0,1000}\\RPCConfig\.ini.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
945*\RPCCoreViewer.exe*.{0,1000}\\RPCCoreViewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
946*\RpcDND_Console.exe*.{0,1000}\\RpcDND_Console\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
947*\RPCDownloader.exe*.{0,1000}\\RPCDownloader\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
948*\RPCDownloaderLogFile.txt*.{0,1000}\\RPCDownloaderLogFile\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
949*\RPCDragDrop.txt*.{0,1000}\\RPCDragDrop\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
950*\RPCFirewallAttended.exe*.{0,1000}\\RPCFirewallAttended\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
951*\RPCFireWallRule.exe*.{0,1000}\\RPCFireWallRule\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
952*\RPCFireWallRulelogfile.txt*.{0,1000}\\RPCFireWallRulelogfile\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
953*\RPCKeyMouseHandler.txt*.{0,1000}\\RPCKeyMouseHandler\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
954*\RPCOTABootstrapper.exe*.{0,1000}\\RPCOTABootstrapper\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
955*\RPCOTADesktop.exe*.{0,1000}\\RPCOTADesktop\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
956*\RPCOTADesktopUAC.exe*.{0,1000}\\RPCOTADesktopUAC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
957*\RpcOTADND_Console.exe*.{0,1000}\\RpcOTADND_Console\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
958*\RPCOTAElevator.exe*.{0,1000}\\RPCOTAElevator\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
959*\RPCOTAFTHost.exe*.{0,1000}\\RPCOTAFTHost\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
960*\RPCOTAKillService.exe*.{0,1000}\\RPCOTAKillService\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
961*\RPCOTARelauncher.exe*.{0,1000}\\RPCOTARelauncher\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
962*\RPCOTAService.exe*.{0,1000}\\RPCOTAService\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
963*\RPCOTAServiceUAC.exe*.{0,1000}\\RPCOTAServiceUAC\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
964*\RPCOTAUtilityHost.exe*.{0,1000}\\RPCOTAUtilityHost\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
965*\RPCOTAViewerHostKeyPopup.exe*.{0,1000}\\RPCOTAViewerHostKeyPopup\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
966*\RPCPerformanceService.exe*.{0,1000}\\RPCPerformanceService\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
967*\RPCPerformanceService.log*.{0,1000}\\RPCPerformanceService\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
968*\RPCPerfViewer.exe*.{0,1000}\\RPCPerfViewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
969*\rpcperfviewer.exe*.{0,1000}\\rpcperfviewer\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
970*\RPCPerfViewer.log*.{0,1000}\\RPCPerfViewer\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
971*\RPCPing.txt*.{0,1000}\\RPCPing\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
972*\RPCPreUninstall.log*.{0,1000}\\RPCPreUninstall\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
973*\RPCPreUninstall.log*.{0,1000}\\RPCPreUninstall\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
974*\RPCPrinterDownloader.exe*.{0,1000}\\RPCPrinterDownloader\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
975*\RPCPrinterDownloader.txt*.{0,1000}\\RPCPrinterDownloader\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
976*\RPCProxyLatency.exe*.{0,1000}\\RPCProxyLatency\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
977*\RPCProxyLatencyAttended.exe*.{0,1000}\\RPCProxyLatencyAttended\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
978*\RPCSettings.ini*.{0,1000}\\RPCSettings\.ini.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
979*\RpcStickyNotes.exe*.{0,1000}\\RpcStickyNotes\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
980*\RPCSuite_*_Inc.log*.{0,1000}\\RPCSuite_.{0,1000}_Inc\.log.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
981*\RPCsuiteLaunch.txt*.{0,1000}\\RPCsuiteLaunch\.txt.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
982*\rserver3.exe*.{0,1000}\\rserver3\.exe.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
983*\rsetup64.exe*/stop*.{0,1000}\\rsetup64\.exe.{0,1000}\/stop.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
984*\rsl.exe /setup*.{0,1000}\\rsl\.exe\s\/setup.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
985*\rsl.exe*/stop*.{0,1000}\\rsl\.exe.{0,1000}\/stop.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
986*\RSTemp\ZohoMeeting\*.{0,1000}\\RSTemp\\ZohoMeeting\\.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
987*\RunOnce\*LogMeInRescue_*.{0,1000}\\RunOnce\\.{0,1000}LogMeInRescue_.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
988*\rustdesk-*-x86_64.exe*.{0,1000}\\rustdesk\-.{0,1000}\-x86_64\.exe.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
989*\RustDesk.exe*.{0,1000}\\RustDesk\.exe.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
990*\RustDesk.lnk*.{0,1000}\\RustDesk\.lnk.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
991*\RustDesk\query*.{0,1000}\\RustDesk\\query.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/Anamed pipe101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
992*\RustDeskIddDriver\*.{0,1000}\\RustDeskIddDriver\\.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
993*\rutserv.exe*.{0,1000}\\rutserv\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
994*\rutview.exe*.{0,1000}\\rutview\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
995*\ru-viewer-portable\*.{0,1000}\\ru\-viewer\-portable\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
996*\Safeboot\Network\AltMeshAgent*.{0,1000}\\Safeboot\\Network\\AltMeshAgent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
997*\SafeBoot\Network\ShTemporaryService*.{0,1000}\\SafeBoot\\Network\\ShTemporaryService.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A
998*\SafeBoot\Network\SimpleHelp Server*.{0,1000}\\SafeBoot\\Network\\SimpleHelp\sServer.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A
999*\SafeBoot\Network\Zoho Assist-Remote Support*.{0,1000}\\SafeBoot\\Network\\Zoho\sAssist\-Remote\sSupport.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1000*\Schedule\TaskCache\Tree\RemotePC*.{0,1000}\\Schedule\\TaskCache\\Tree\\RemotePC.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A
1001*\ScreenConnect Client (*.{0,1000}\\ScreenConnect\sClient\s\(.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1002*\ScreenConnect.Client.exe*.{0,1000}\\ScreenConnect\.Client\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMscreenconnect.com10N/AN/A1010N/AN/AN/AN/A
1003*\ScreenConnect.ClientService.exe*.{0,1000}\\ScreenConnect\.ClientService\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/10N/AN/A1010N/AN/AN/AN/A
1004*\ScreenConnect.ClientSetup.exe*.{0,1000}\\ScreenConnect\.ClientSetup\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/10N/AN/A1010N/AN/AN/AN/A
1005*\ScreenConnect.Core.dll*.{0,1000}\\ScreenConnect\.Core\.dll.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1006*\ScreenConnect.InstallerActions.dll*.{0,1000}\\ScreenConnect\.InstallerActions\.dll.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1007*\ScreenConnect.Windows.dll*.{0,1000}\\ScreenConnect\.Windows\.dll.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1008*\ScreenConnect.WindowsBackstageShell.exe*.{0,1000}\\ScreenConnect\.WindowsBackstageShell\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/10N/AN/A1010N/AN/AN/AN/A
1009*\ScreenConnect.WindowsClient.exe*.{0,1000}\\ScreenConnect\.WindowsClient\.exe.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/10N/AN/A1010N/AN/AN/AN/A
1010*\ScreenConnect\Bin\*.{0,1000}\\ScreenConnect\\Bin\\.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1011*\Scripts\CreateRegKey.scp*.{0,1000}\\Scripts\\CreateRegKey\.scp.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1012*\Scripts\DirLst.log*.{0,1000}\\Scripts\\DirLst\.log.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1013*\Scripts\DirLst.scp*.{0,1000}\\Scripts\\DirLst\.scp.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1014*\Scripts\DrvSize.scp*.{0,1000}\\Scripts\\DrvSize\.scp.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1015*\Scripts\writetofile.scp*.{0,1000}\\Scripts\\writetofile\.scp.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1016*\Service Install Overwrite Remote CFG*.{0,1000}\\Service\sInstall\sOverwrite\sRemote\sCFG.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1017*\Services\AteraAgent*.{0,1000}\\Services\\AteraAgent.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
1018*\Services\DWAgent*.{0,1000}\\Services\\DWAgent.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
1019*\Services\EventLog\Application\UltraVNC\*.{0,1000}\\Services\\EventLog\\Application\\UltraVNC\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A
1020*\Services\EventLog\Application\VSA X*.{0,1000}\\Services\\EventLog\\Application\\VSA\sX.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A
1021*\Services\EventLog\Application\VSAX*.{0,1000}\\Services\\EventLog\\Application\\VSAX.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A
1022*\Services\RemotePCAttendedService*.{0,1000}\\Services\\RemotePCAttendedService.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
1023*\Services\SimpleHelp Server*.{0,1000}\\Services\\SimpleHelp\sServer.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A
1024*\Services\TeamViewer\*.{0,1000}\\Services\\TeamViewer\\.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10#registryFP risk - teamviewer usage1010N/AN/AN/AN/A
1025*\SFT: Enable Simple File Transfer*.{0,1000}\\SFT\:\sEnable\sSimple\sFile\sTransfer.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1026*\simplegateway.service"*.{0,1000}\\simplegateway\.service\".{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
1027*\SimpleHelp TechnicianEmbedExample.html*.{0,1000}\\SimpleHelp\sTechnicianEmbedExample\.html.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
1028*\SimpleHelp.RemoteWork.127_0_0_1*.{0,1000}\\SimpleHelp\.RemoteWork\.127_0_0_1.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A
1029*\SimpleHelp.Technician.127_0_0_1*.{0,1000}\\SimpleHelp\.Technician\.127_0_0_1.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A
1030*\simplehelper64.exe*.{0,1000}\\simplehelper64\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
1031*\simplehelp-rw\shell*.{0,1000}\\simplehelp\-rw\\shell.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10#registryregistry1010N/AN/AN/AN/A
1032*\simplehelpuninstall.exe*.{0,1000}\\simplehelpuninstall\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
1033*\SimpleService.exe*.{0,1000}\\SimpleService\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
1034*\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\*.{0,1000}\\slave\\workspace\\GIT_WIN_SRS_Formal\\Source\\irisserver\\.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7210N/AN/A1010N/AN/AN/AN/A
1035*\SOFTWARE\Ammyy\Admin*.{0,1000}\\SOFTWARE\\Ammyy\\Admin.{0,1000}greyware_tool_keywordAmmyy AdminAmmyy Admin is a remote desktop software application abudsed by attackersT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AAnunakRMMhttps://www.ammyy.com10#registryN/A1010N/AN/AN/AN/A
1036*\Software\AweSun\SunLogin\SunloginClient*.{0,1000}\\Software\\AweSun\\SunLogin\\SunloginClient.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10#registryN/A1010N/AN/AN/AN/A
1037*\SOFTWARE\Clients\Media\AnyDesk*.{0,1000}\\SOFTWARE\\Clients\\Media\\AnyDesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/10#registryrisk of false positives - compliance detection1010N/AN/AN/AN/A
1038*\SOFTWARE\ITarian\RemoteControl*.{0,1000}\\SOFTWARE\\ITarian\\RemoteControl.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#registryN/A1010N/AN/AN/AN/A
1039*\SOFTWARE\Kaseya\*.{0,1000}\\SOFTWARE\\Kaseya\\.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A
1040*\SOFTWARE\Level Platforms\Managed Workplace\*.{0,1000}\\SOFTWARE\\Level\sPlatforms\\Managed\sWorkplace\\.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10#registryN/A1010N/AN/AN/AN/A
1041*\Software\LogMeInRescue\*.{0,1000}\\Software\\LogMeInRescue\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10#registryN/A1010N/AN/AN/AN/A
1042*\SOFTWARE\Microsoft\Tracing\PCMonitorSrv_RAS*.{0,1000}\\SOFTWARE\\Microsoft\\Tracing\\PCMonitorSrv_RAS.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10#registryregistry1010N/AN/AN/AN/A
1043*\SOFTWARE\Microsoft\Tracing\Quick Assist Installer*.{0,1000}\\SOFTWARE\\Microsoft\\Tracing\\Quick\sAssist\sInstaller.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510#registryQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
1044*\Software\NetSupport Ltd\*.{0,1000}\\Software\\NetSupport\sLtd\\.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A
1045*\SOFTWARE\ORL\VNCHooks\Application_Prefs\WinVNC*.{0,1000}\\SOFTWARE\\ORL\\VNCHooks\\Application_Prefs\\WinVNC.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A
1046*\SOFTWARE\Supremo\*.{0,1000}\\SOFTWARE\\Supremo\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#registryregistry1010N/AN/AN/AN/A
1047*\Software\Supremo\Printer\*.{0,1000}\\Software\\Supremo\\Printer\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#registryregistry1010N/AN/AN/AN/A
1048*\Software\TeamViewer\Temp*.{0,1000}\\Software\\TeamViewer\\Temp.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10#registryFP risk - teamviewer usage1010N/AN/AN/AN/A
1049*\SOFTWARE\Usoris\Remote Utilities\*.{0,1000}\\SOFTWARE\\Usoris\\Remote\sUtilities\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A
1050*\SOFTWARE\WOW6432Node\ITarian\ITSM\*.{0,1000}\\SOFTWARE\\WOW6432Node\\ITarian\\ITSM\\.{0,1000}greyware_tool_keywordComodoRMM (Itarian RMM)Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://one.comodo.com/10#registryN/A1010N/AN/AN/AN/A
1051*\SOFTWARE\WOW6432Node\Supremo\*.{0,1000}\\SOFTWARE\\WOW6432Node\\Supremo\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10#registryregistry1010N/AN/AN/AN/A
1052*\SOFTWARE\WOW6432Node\TightVNC\*.{0,1000}\\SOFTWARE\\WOW6432Node\\TightVNC\\.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10#registryregistry1010N/AN/AN/AN/A
1053*\SOFTWARE\Zoho Assist*.{0,1000}\\SOFTWARE\\Zoho\sAssist.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10#registryN/A1010N/AN/AN/AN/A
1054*\SolarWinds.DepInjectedClassWalker.dll*.{0,1000}\\SolarWinds\.DepInjectedClassWalker\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1055*\SolarWinds.Diags.Contract.dll*.{0,1000}\\SolarWinds\.Diags\.Contract\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1056*\SolarWinds.Diags.DameWare.Extensions.dll*.{0,1000}\\SolarWinds\.Diags\.DameWare\.Extensions\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1057*\SolarWinds.Diags.exe*.{0,1000}\\SolarWinds\.Diags\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1058*\SolarWinds.Diags.exe.config*.{0,1000}\\SolarWinds\.Diags\.exe\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1059*\SolarWinds.Diags.Extensions.Common.dll*.{0,1000}\\SolarWinds\.Diags\.Extensions\.Common\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1060*\SolarWinds.Diags.Extensions.dll*.{0,1000}\\SolarWinds\.Diags\.Extensions\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1061*\SolarWinds.Diags.Platform.Extensions.dll*.{0,1000}\\SolarWinds\.Diags\.Platform\.Extensions\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1062*\SolarWinds.Diags.Strings.dll*.{0,1000}\\SolarWinds\.Diags\.Strings\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1063*\SOLARWINDS.DRS.LICENSOR.EXE-*.{0,1000}\\SOLARWINDS\.DRS\.LICENSOR\.EXE\-.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
1064*\SolarWinds.LicenseManager.msi*.{0,1000}\\SolarWinds\.LicenseManager\.msi.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1065*\SolarWinds.Licensing.Gen4.dll*.{0,1000}\\SolarWinds\.Licensing\.Gen4\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1066*\SolarWinds.Licensing.Gen4.dll.config*.{0,1000}\\SolarWinds\.Licensing\.Gen4\.dll\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1067*\SolarWinds.Licensing.Gen4.Resources.dll*.{0,1000}\\SolarWinds\.Licensing\.Gen4\.Resources\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1068*\SolarWinds.Licensing.Gen4.UI.dll*.{0,1000}\\SolarWinds\.Licensing\.Gen4\.UI\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1069*\SolarWinds.Licensing.MRC.COMWrapper.dll*.{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1070*\SolarWinds.Licensing.MRC.COMWrapper.dll.config*.{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.dll\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1071*\SolarWinds.Licensing.MRC.COMWrapper.tlb*.{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.tlb.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1072*\SolarWinds.Logging.dll*.{0,1000}\\SolarWinds\.Logging\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1073*\SolarWinds.MRC.Licensor.exe*.{0,1000}\\SolarWinds\.MRC\.Licensor\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1074*\SolarWinds.MRC.Licensor.exe*.{0,1000}\\SolarWinds\.MRC\.Licensor\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1075*\SolarWinds.MRC.Licensor.exe.config*.{0,1000}\\SolarWinds\.MRC\.Licensor\.exe\.config.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1076*\SolarWinds.MRC.Licensor.log*.{0,1000}\\SolarWinds\.MRC\.Licensor\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1077*\SolarWinds.Pluggability.Contract.dll*.{0,1000}\\SolarWinds\.Pluggability\.Contract\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1078*\SolarWinds.Pluggability.dll*.{0,1000}\\SolarWinds\.Pluggability\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1079*\SolarWinds\Dameware Mini Remote Control*.{0,1000}\\SolarWinds\\Dameware\sMini\sRemote\sControl.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1080*\SolarWinds\Logs\Dameware*.{0,1000}\\SolarWinds\\Logs\\Dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/dameware-mini-remote-control10N/ADameware Mini Remote Control1010N/AN/AN/AN/A
1081*\SOLARWINDS-DAMEWARE-DRS-ST.EX-*.{0,1000}\\SOLARWINDS\-DAMEWARE\-DRS\-ST\.EX\-.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
1082*\SolarWinds-Dameware-DRS-St.exe*.{0,1000}\\SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Mini Remote Control tool T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/ADameware Remote Support1010N/AN/AN/AN/A
1083*\Splashtop Remote\*.{0,1000}\\Splashtop\sRemote\\.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7210N/AN/A1010N/AN/AN/AN/A
1084*\Splashtop\Temp\*.{0,1000}\\Splashtop\\Temp\\.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10N/AN/A1010N/AN/AN/AN/A
1085*\Splashtop\Temp\log\FTCLog.txt*.{0,1000}\\Splashtop\\Temp\\log\\FTCLog\.txt.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10N/AN/A1010N/AN/AN/AN/A
1086*\spool\drivers\x64\rupd.*.{0,1000}\\spool\\drivers\\x64\\rupd\..{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1087*\SRService.exe*.{0,1000}\\SRService\.exe.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7210N/AN/A1010N/AN/AN/AN/A
1088*\start dameware remote everywhere agent.lnk*.{0,1000}\\start\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1089*\Start Menu\Programs\Advanced Monitoring Agent.lnk*.{0,1000}\\Start\sMenu\\Programs\\Advanced\sMonitoring\sAgent\.lnk.{0,1000}greyware_tool_keywordNsight RMMNsight RMM usageT1021 - T1219 - T1563 - T1608TA0002 - TA0008 - TA0011 - TA0040N/AScattered Spider*RMMhttps://www.n-able.com/products/n-sight-rmm10N/AN/A1010N/AN/AN/AN/A
1090*\start menu\programs\dameware*.{0,1000}\\start\smenu\\programs\\dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1091*\Start Menu\Programs\DWAgent*.{0,1000}\\Start\sMenu\\Programs\\DWAgent.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
1092*\Start Menu\Programs\LogMeIn Rescue\*.{0,1000}\\Start\sMenu\\Programs\\LogMeIn\sRescue\\.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
1093*\Start Menu\Programs\LogMeIn*.{0,1000}\\Start\sMenu\\Programs\\LogMeIn.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
1094*\Start Menu\Programs\NetSupport*.{0,1000}\\Start\sMenu\\Programs\\NetSupport.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1095*\Start Menu\Programs\Radmin Server *.{0,1000}\\Start\sMenu\\Programs\\Radmin\sServer\s.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
1096*\Start Menu\Programs\Radmin Viewer *.{0,1000}\\Start\sMenu\\Programs\\Radmin\sViewer\s.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
1097*\StopSimpleGatewayService.exe*.{0,1000}\\StopSimpleGatewayService\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
1098*\strwinclt.exe*.{0,1000}\\strwinclt\.exe.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c7210N/AN/A1010N/AN/AN/AN/A
1099*\Supremo Remote Printer\*.{0,1000}\\Supremo\sRemote\sPrinter\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
1100*\Supremo.exe*.{0,1000}\\Supremo\.exe.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
1101*\SUPREMO.EXE-*.pf*.{0,1000}\\SUPREMO\.EXE\-.{0,1000}\.pf.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
1102*\Supremo_Client_2*.{0,1000}\\Supremo_Client_2.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/Apipename1010N/AN/AN/AN/A
1103*\Supremo_Helper_2*.{0,1000}\\Supremo_Helper_2.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/Apipename1010N/AN/AN/AN/A
1104*\Supremo_Service*.{0,1000}\\Supremo_Service.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/Apipename1010N/AN/AN/AN/A
1105*\SupremoHelper.exe*.{0,1000}\\SupremoHelper\.exe.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
1106*\SupremoRemoteDesktop\*.{0,1000}\\SupremoRemoteDesktop\\.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
1107*\System32\rupdpm.dll*.{0,1000}\\System32\\rupdpm\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1108*\SysWOW64\rserver30\FamItrf2*.{0,1000}\\SysWOW64\\rserver30\\FamItrf2.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
1109*\SysWOW64\rserver30\FamItrfc*.{0,1000}\\SysWOW64\\rserver30\\FamItrfc.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
1110*\tacticalagent-v*-linux-arm.exe*.{0,1000}\\tacticalagent\-v.{0,1000}\-linux\-arm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
1111*\tacticalagent-v*-windows-amd64.exe*.{0,1000}\\tacticalagent\-v.{0,1000}\-windows\-amd64\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
1112*\tacticalrmm.exe*.{0,1000}\\tacticalrmm\.exe.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
1113*\tacticalrmm\*.{0,1000}\\tacticalrmm\\.{0,1000}greyware_tool_keywordtacticalrmmA remote monitoring & management toolT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/AAvosLocker - Scattered Spider*RMMhttps://github.com/amidaware/tacticalrmm10N/AN/A101032764502024-11-28T19:56:21Z2019-10-22T22:19:12Z
1114*\TaskCache\Tree\VSA XServiceCheck*.{0,1000}\\TaskCache\\Tree\\VSA\sXServiceCheck.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A
1115*\Tasks\PulsewayServiceCheck*.{0,1000}\\Tasks\\PulsewayServiceCheck.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
1116*\tcdirectchat.exe*.{0,1000}\\tcdirectchat\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1117*\tcdirectchatde.dll*.{0,1000}\\tcdirectchatde\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1118*\tcdirectchaten.dll*.{0,1000}\\tcdirectchaten\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1119*\tcdirectchates.dll*.{0,1000}\\tcdirectchates\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1120*\tcdirectchatfr.dll*.{0,1000}\\tcdirectchatfr\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1121*\tcdirectchatit.dll*.{0,1000}\\tcdirectchatit\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1122*\tcdirectchatpt.dll*.{0,1000}\\tcdirectchatpt\.dll.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1123*\tcrmtshellagent.exe*.{0,1000}\\tcrmtshellagent\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1124*\tcrmtshellagent_*.log*.{0,1000}\\tcrmtshellagent_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1125*\tcrmtshellagentmodule_*.{0,1000}\\tcrmtshellagentmodule_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1126*\tcrmtshellviewer.exe*.{0,1000}\\tcrmtshellviewer\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1127*\tcrmtshellviewer_*.log*.{0,1000}\\tcrmtshellviewer_.{0,1000}\.log.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1128*\tcrmtshellviewermodule_*.{0,1000}\\tcrmtshellviewermodule_.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1129*\TeamViewer.exe*.{0,1000}\\TeamViewer\.exe.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1130*\TeamViewer\Connections.txt*.{0,1000}\\TeamViewer\\Connections\.txt.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1131*\TeamViewer\Connections_incoming.txt*.{0,1000}\\TeamViewer\\Connections_incoming\.txt.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1132*\TeamViewer_.ex*.{0,1000}\\TeamViewer_\.ex.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1133*\teamviewer_note.exe*.{0,1000}\\teamviewer_note\.exe.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1134*\TeamViewerSession\shell\open*.{0,1000}\\TeamViewerSession\\shell\\open.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1135*\TeamViewerTermsOfUseAccepted*.{0,1000}\\TeamViewerTermsOfUseAccepted.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1136*\Temp\AnyDeskUninst*.{0,1000}\\Temp\\AnyDeskUninst.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
1137*\TEMP\AteraUpgradeAgentPackage\*.{0,1000}\\TEMP\\AteraUpgradeAgentPackage\\.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10N/AN/A1010N/AN/AN/AN/A
1138*\Temp\install_windows.exe*.{0,1000}\\Temp\\install_windows\.exe.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
1139*\TEMP\ScreenConnect\*.ps1*.{0,1000}\\TEMP\\ScreenConnect\\.{0,1000}\.ps1.{0,1000}greyware_tool_keywordScreenConnectcontrol remote servers - abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMscreenconnect.com10N/AN/A1010N/AN/AN/AN/A
1140*\Temp\ScreenConnect\*\setup.msi*.{0,1000}\\Temp\\ScreenConnect\\.{0,1000}\\setup\.msi.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1141*\Temp\SupremoRemoteDesktop*.{0,1000}\\Temp\\SupremoRemoteDesktop.{0,1000}greyware_tool_keywordSupremoSupremo - Remote access softwareT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ABlack BastaRMMhttps://www.supremocontrol.com10N/AN/A1010N/AN/AN/AN/A
1142*\Temp\XEOX*.{0,1000}\\Temp\\XEOX.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10N/AN/A1010N/AN/AN/AN/A
1143*\test_rustdesk.log*.{0,1000}\\test_rustdesk\.log.{0,1000}greyware_tool_keywordRustDeskRustdesk open suorce remote control software abused by scammersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AAkira - Scattered Spider*RMMhttps://github.com/rustdesk/rustdesk10N/AN/A101077219104972024-12-07T14:34:54Z2020-09-28T15:36:08Z
1144*\TightVNC Server*.{0,1000}\\TightVNC\sServer.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/AN/A1010N/AN/AN/AN/A
1145*\tightvnc-*.{0,1000}\\tightvnc\-.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/AN/A1010N/AN/AN/AN/A
1146*\TightVNC_Service_Control*.{0,1000}\\TightVNC_Service_Control.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/Anamed pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L21010N/AN/AN/AN/A
1147*\tkcuploader.exe*.{0,1000}\\tkcuploader\.exe.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1148*\Tools\Ninja.WebSockets.dll*.{0,1000}\\Tools\\Ninja\.WebSockets\.dll.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
1149*\Tracing\RemotePCLauncher_*.{0,1000}\\Tracing\\RemotePCLauncher_.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A
1150*\Tracing\RemotePCUIU*.{0,1000}\\Tracing\\RemotePCUIU.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A
1151*\TransferClient.exe.config*.{0,1000}\\TransferClient\.exe\.config.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
1152*\TransferServer.exe.config*.{0,1000}\\TransferServer\.exe\.config.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
1153*\TV15Install.log*.{0,1000}\\TV15Install\.log.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1154*\TVExtractTemp\TeamViewer_Resource_*.{0,1000}\\TVExtractTemp\\TeamViewer_Resource_.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1155*\TVExtractTemp\tvfiles.7z*.{0,1000}\\TVExtractTemp\\tvfiles\.7z.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1156*\TvGetVersion.dll*.{0,1000}\\TvGetVersion\.dll.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1157*\TVN_log_pipe_public_name*.{0,1000}\\TVN_log_pipe_public_name.{0,1000}greyware_tool_keywordtightvncTightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.tightvnc.com10N/Anamed pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L21010N/AN/AN/AN/A
1158*\TVNetwork.log*.{0,1000}\\TVNetwork\.log.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1159*\TVWebRTC.dll*.{0,1000}\\TVWebRTC\.dll.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1160*\Two Pilots\Agent\Remote Utilities Printer*.{0,1000}\\Two\sPilots\\Agent\\Remote\sUtilities\sPrinter.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10#registryregistry1010N/AN/AN/AN/A
1161*\ultravnc.cer*.{0,1000}\\ultravnc\.cer.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1162*\UltraVNC.ini*.{0,1000}\\UltraVNC\.ini.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1163*\unidrv_rupd.dll*.{0,1000}\\unidrv_rupd\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1164*\unidrv_rupd.hlp*.{0,1000}\\unidrv_rupd\.hlp.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1165*\unidrvui_rupd.dll*.{0,1000}\\unidrvui_rupd\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1166*\Uninstall\MeshCentralAgent*.{0,1000}\\Uninstall\\MeshCentralAgent.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshAgent10N/AN/A103235902024-11-26T20:49:56Z2017-10-12T21:26:52Z
1167*\unires_vpd.dll*.{0,1000}\\unires_vpd\.dll.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1168*\Users\mthcht\AppData\Roaming\SubDir\Client.exe*.{0,1000}\\Users\\mthcht\\AppData\\Roaming\\SubDir\\Client\.exe.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
1169*\Users\Public\Desktop\TVTest.tmp*.{0,1000}\\Users\\Public\\Desktop\\TVTest\.tmp.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1170*\uvnc bvba\UltraVNC\*.{0,1000}\\uvnc\sbvba\\UltraVNC\\.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1171*\uvnc_launch.exe*.{0,1000}\\uvnc_launch\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A
1172*\uvnc_settings.ex*.{0,1000}\\uvnc_settings\.ex.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10#registryregistry path1010N/AN/AN/AN/A
1173*\uvnc_settings.exe*.{0,1000}\\uvnc_settings\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1174*\uvnckeyboardhelper.exe*.{0,1000}\\uvnckeyboardhelper\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1175*\Videos\AnyDesk*.{0,1000}\\Videos\\AnyDesk.{0,1000}greyware_tool_keywordanydeskAnydesk RMM usageT1021 - T1071 - T1090TA0008 - TA0011N/ABlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - DispossessorRMMhttps://anydesk.com/10N/Arisk of false positives - compliance detection1010N/AN/AN/AN/A
1176*\ViewerHostKeyPopup.exe*.{0,1000}\\ViewerHostKeyPopup\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC Remote administration toolT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotepc.com/10N/AN/A1010N/AN/AN/AN/A
1177*\ViewerHostKeyPopup.exe*.{0,1000}\\ViewerHostKeyPopup\.exe.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10N/AN/A1010N/AN/AN/AN/A
1178*\viewer-portable-7.2.2.0\*.{0,1000}\\viewer\-portable\-7\.2\.2\.0\\.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1179*\vncviewer.exe*.{0,1000}\\vncviewer\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1180*\VPDAgent.exe*.{0,1000}\\VPDAgent\.exe.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1181*\VSA X Manager.lnk*.{0,1000}\\VSA\sX\sManager\.lnk.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
1182*\VSA X Remote Control.lnk*.{0,1000}\\VSA\sX\sRemote\sControl\.lnk.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
1183*\VSA X Remote Control\*.{0,1000}\\VSA\sX\sRemote\sControl\\.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
1184*\VSA X\watchdog.bat*.{0,1000}\\VSA\sX\\watchdog\.bat.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A
1185*\VSA XServiceCheck*.{0,1000}\\VSA\sXServiceCheck.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10#registryregistry1010N/AN/AN/AN/A
1186*\VSAX\working*.{0,1000}\\VSAX\\working.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
1187*\VSAX_x64.msi*.{0,1000}\\VSAX_x64\.msi.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
1188*\vsxrc-clip.exe*.{0,1000}\\vsxrc\-clip\.exe.{0,1000}greyware_tool_keywordkaseya VSAKaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.kaseya.com/products/vsa/10N/AN/A1010N/AN/AN/AN/A
1189*\Win7Taskbar.dll*.{0,1000}\\Win7Taskbar\.dll.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1190*\Windows\Action1\scripts\*.{0,1000}\\Windows\\Action1\\scripts\\.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A
1191*\Windows\system32\SubDir\Client.exe*.{0,1000}\\Windows\\system32\\SubDir\\Client\.exe.{0,1000}greyware_tool_keywordQuasarOpen-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040N/APatchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - MoleratsRMMhttps://github.com/quasar/Quasar10N/AN/AN/A10882724902024-02-29T06:37:37Z2014-07-08T12:27:59Z
1192*\Windows\SysWOW64\rserver30\*.{0,1000}\\Windows\\SysWOW64\\rserver30\\.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10N/AN/A1010N/AN/AN/AN/A
1193*\Windows\Temp\ScreenConnect\*.cmd*.{0,1000}\\Windows\\Temp\\ScreenConnect\\.{0,1000}\.cmd.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1194*\Windows\Temp\ScreenConnect\*.ps1*.{0,1000}\\Windows\\Temp\\ScreenConnect\\.{0,1000}\.ps1.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1195*\Windows\Temp\TeamViewer*.{0,1000}\\Windows\\Temp\\TeamViewer.{0,1000}greyware_tool_keywordteamviewerTeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackersT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/ALockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDARMMhttps://www.teamviewer.com/10N/AFP risk - teamviewer usage1010N/AN/AN/AN/A
1196*\WindowsApps\MicrosoftCorporationII.QuickAssist_*.{0,1000}\\WindowsApps\\MicrosoftCorporationII\.QuickAssist_.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
1197*\winpty-agent64.exe*.{0,1000}\\winpty\-agent64\.exe.{0,1000}greyware_tool_keywordSimpleHelpSimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackCatRMMsimple-help.com10N/AN/A1010N/AN/AN/AN/A
1198*\WinSxS\amd64_microsoft-windows-quickassist_*.{0,1000}\\WinSxS\\amd64_microsoft\-windows\-quickassist_.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
1199*\winvnc.exe*.{0,1000}\\winvnc\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1200*\winvncsc.exe*.{0,1000}\\winvncsc\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1201*\winwvc.exe*.{0,1000}\\winwvc\.exe.{0,1000}greyware_tool_keywordUltraVNCUltraVNC remote access software usageT1021.001 - T1219 - T1076 - T1563.002TA0008 - TA0009 - TA0010 - TA0011N/ADispossessor - Gamaredon Group - APT39RMMhttps://uvnc.com/downloads/ultravnc.html10N/AN/A1010N/AN/AN/AN/A
1202*\WOW6432Node\Citrix\GoToMyPc*.{0,1000}\\WOW6432Node\\Citrix\\GoToMyPc.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
1203*\wow6432node\multiplicar negocios\bace_dameware*.{0,1000}\\wow6432node\\multiplicar\snegocios\\bace_dameware.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1204*\WOW6432Node\RemotePC*.{0,1000}\\WOW6432Node\\RemotePC.{0,1000}greyware_tool_keywordRemotePCRemotePC RMM tool - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.remotedesktop.com/10#registryregistry1010N/AN/AN/AN/A
1205*\WOW6432Node\Splashtop Inc.\Splashtop Remote Server*.{0,1000}\\WOW6432Node\\Splashtop\sInc\.\\Splashtop\sRemote\sServer.{0,1000}greyware_tool_keywordSplashtopcontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlack Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - CactusRMMhttps://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/10N/AN/A1010N/AN/AN/AN/A
1206*\x64\monblanking.sys*.{0,1000}\\x64\\monblanking\.sys.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
1207*\XEOX\Agent Watchdog on Boot*.{0,1000}\\XEOX\\Agent\sWatchdog\son\sBoot.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10#scheduledtaskN/A1010N/AN/AN/AN/A
1208*\XEOX\Agent Watchdog on Wakeup*.{0,1000}\\XEOX\\Agent\sWatchdog\son\sWakeup.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10#scheduledtaskN/A1010N/AN/AN/AN/A
1209*\XEOX\Agent Watchdog*.{0,1000}\\XEOX\\Agent\sWatchdog.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10#scheduledtaskN/A1010N/AN/AN/AN/A
1210*\XEOX_cloud_agent_install.bat*.{0,1000}\\XEOX_cloud_agent_install\.bat.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10N/AN/A1010N/AN/AN/AN/A
1211*\XEOXAgent.exe*.{0,1000}\\XEOXAgent\.exe.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10N/AN/A1010N/AN/AN/AN/A
1212*\xeox-agent_x64\*.{0,1000}\\xeox\-agent_x64\\.{0,1000}greyware_tool_keywordxeoxEasily access and manage Windows devices remotely within XEOX - RMM abused by threat actorsT1021 - T1078 - T1219 - T1105 - T1046TA0011 - TA0010 - TA0003 - TA0005N/ADispossessorRMMhttps://xeox.com/remote-access/10N/AN/A1010N/AN/AN/AN/A
1213*\ZA_Connect.exe*.{0,1000}\\ZA_Connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1214*\ZA_Upgrader*.{0,1000}\\ZA_Upgrader.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1215*\ZAAudioClient.exe*.{0,1000}\\ZAAudioClient\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1216*\ZAFileTransfer.exe*.{0,1000}\\ZAFileTransfer\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1217*\ZAService.exe*.{0,1000}\\ZAService\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1218*\ZAudioClientPipe_*ServerReadPipe*.{0,1000}\\ZAudioClientPipe_.{0,1000}ServerReadPipe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1219*\ZAudioClientPipe_*ServerWritePipe*.{0,1000}\\ZAudioClientPipe_.{0,1000}ServerWritePipe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1220*\ZMAgent.exe*.{0,1000}\\ZMAgent\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1221*\Zoho Assist\Zoho Assist Remote support*.{0,1000}\\Zoho\sAssist\\Zoho\sAssist\sRemote\ssupport.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1222*\ZohoMeeting.7z*.{0,1000}\\ZohoMeeting\.7z.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1223*\ZohoMeeting.exe*.{0,1000}\\ZohoMeeting\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1224*\ZohoMeeting\agent.exe*.{0,1000}\\ZohoMeeting\\agent\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1225*\zohomeeting\agent.exe*.{0,1000}\\zohomeeting\\agent\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1226*\ZohoMeeting\agent_ui.exe*.{0,1000}\\ZohoMeeting\\agent_ui\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1227*\ZohoMeeting\Connect.exe*.{0,1000}\\ZohoMeeting\\Connect\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1228*\ZohoMeeting\Connection.conf*.{0,1000}\\ZohoMeeting\\Connection\.conf.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1229*\ZohoMeeting\log\*.log*.{0,1000}\\ZohoMeeting\\log\\.{0,1000}\.log.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1230*\ZohoMeeting\ViewerUI.exe*.{0,1000}\\ZohoMeeting\\ViewerUI\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1231*\ZohoTray.exe*.{0,1000}\\ZohoTray\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1232*\ZohoURS.exe*.{0,1000}\\ZohoURS\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1233*\ZohoURSService.exe*.{0,1000}\\ZohoURSService\.exe.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1234*_Classes\zohoassistlaunchv2*.{0,1000}_Classes\\zohoassistlaunchv2.{0,1000}greyware_tool_keywordZoho AssistZoho Assist Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ALockBit - Scattered Spider*RMMhttps://www.zoho.com/assist/10N/AN/A1010N/AN/AN/AN/A
1235*_NetSupport_NetSupport Manager_*.{0,1000}_NetSupport_NetSupport\sManager_.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1236*_renamed_by_Action1*.{0,1000}_renamed_by_Action1.{0,1000}greyware_tool_keywordaction1Action1 remote administration tool abused buy attackerT1021 - T1071 - T1090TA0008 - TA0011N/ALockBit - MONTIRMMhttps://app.action1.com/10N/AN/A1010N/AN/AN/AN/A
1237*<\Level\Level Watchdog>*.{0,1000}\<\\Level\\Level\sWatchdog\>.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
1238*<a href="rutils:*.{0,1000}\<a\shref\=\"rutils\:.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1239*<Alpemix>*.{0,1000}\<Alpemix\>.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A
1240*<AlpemixWEB>*.{0,1000}\<AlpemixWEB\>.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A
1241*<data>dameware remote everywhere</data>*.{0,1000}\<data\>dameware\sremote\severywhere\<\/data\>.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1242*<Data>Installed GoToMyPC</Data>*.{0,1000}\<Data\>Installed\sGoToMyPC\<\/Data\>.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
1243*<Data>LogMeIn, Inc.</Data>*.{0,1000}\<Data\>LogMeIn,\sInc\.\<\/Data\>.{0,1000}greyware_tool_keywordLogMeInLogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ABlackSuit - Royal - Trigona - YanluowangRMMhttps://www.logmein.com10N/AN/A1010N/AN/AN/AN/A
1244*<data>n-able take control</data>*.{0,1000}\<data\>n\-able\stake\scontrol\<\/data\>.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1245*<Data>Product: Chrome Remote Desktop Host*.{0,1000}\<Data\>Product\:\sChrome\sRemote\sDesktop\sHost.{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10#productnameN/A1010N/AN/AN/AN/A
1246*<Data>Product: Remote Utilities - Host -- *.{0,1000}\<Data\>Product\:\sRemote\sUtilities\s\-\sHost\s\-\-\s.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1247*<Data>Pulseway Remote Control</Data>*.{0,1000}\<Data\>Pulseway\sRemote\sControl\<\/Data\>.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
1248*<Data>Received Request Execute automation * script * from device Id*.{0,1000}\<Data\>Received\sRequest\sExecute\sautomation\s.{0,1000}\sscript\s.{0,1000}\sfrom\sdevice\sId.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
1249*<Data>Received Request Get RD pool score *pulseway.com/remote*.{0,1000}\<Data\>Received\sRequest\sGet\sRD\spool\sscore\s.{0,1000}pulseway\.com\/remote.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
1250*<Data>Remote Utilities - Host</Data>*.{0,1000}\<Data\>Remote\sUtilities\s\-\sHost\<\/Data\>.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1251*<Data>Remote Utilities Server<*.{0,1000}\<Data\>Remote\sUtilities\sServer\<.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1252*<Data>Removed Remote Utilities - Host.</Data>*.{0,1000}\<Data\>Removed\sRemote\sUtilities\s\-\sHost\.\<\/Data\>.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1253*<Data>ScreenConnect Software</Data>*.{0,1000}\<Data\>ScreenConnect\sSoftware\<\/Data\>.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1254*<Provider Name="chromoting" />*.{0,1000}\<Provider\sName\=\"chromoting\".{0,1000}greyware_tool_keywordGoogle Remote DesktopGoogle Chrome Remote Desktop to access remote computers - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://remotedesktop.google.com10N/Awindows event logs application provider name1010N/AN/AN/AN/A
1255*<provider name="dameware remote everywhere - [dameware]" />*.{0,1000}\<provider\sname\=\"dameware\sremote\severywhere\s\-\s\[dameware\]\"\s\/\>.{0,1000}greyware_tool_keywordDamewareSolarwind Dameware Remote Control utilitiesT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.solarwinds.com/fr/remote-support-software10N/AN/A1010N/AN/AN/AN/A
1256*<Provider Name="PC Monitor" />*.{0,1000}\<Provider\sName\=\"PC\sMonitor\"\s\/\>.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
1257*<Provider Name="Pulseway" />*.{0,1000}\<Provider\sName\=\"Pulseway\"\s\/\>.{0,1000}greyware_tool_keywordPulsewayPulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://www.pulseway.com/10N/AN/A1010N/AN/AN/AN/A
1258*<Provider Name='Quick Assist'/>*.{0,1000}\<Provider\sName\=\'Quick\sAssist\'\/\>.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
1259*<Provider Name='ScreenConnect Security Manager'/>*.{0,1000}\<Provider\sName\=\'ScreenConnect\sSecurity\sManager\'\/\>.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1260*<Provider Name='ScreenConnect Web Server'/>*.{0,1000}\<Provider\sName\=\'ScreenConnect\sWeb\sServer\'\/\>.{0,1000}greyware_tool_keywordScreenConnectConnectWise Control formerly known as Screenconnect is a remote desktop software application.T1021.001 - T1133TA0008 - TA0009 - TA0010 - TA0011N/ABlack Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater RMMhttps://screenconnect.connectwise.com/download10N/AN/A1010N/AN/AN/AN/A
1261*<Teknopars Bilisim>*.{0,1000}\<Teknopars\sBilisim\>.{0,1000}greyware_tool_keywordAlpemixconnect to your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.alpemix.com/10N/AN/A1010N/AN/AN/AN/A
1262*=http://www.gotomypc.com/downloads/viewer *.{0,1000}\=http\:\/\/www\.gotomypc\.com\/downloads\/viewer\s.{0,1000}greyware_tool_keywordGoToMyPCGoToMyPC is remote desktop software that allows users to access computers remotely using a web browserT1021.001 - T1059 - T1078 - T1133 - T1563TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010N/AN/ARMMhttps://www.gotomypc.com/10N/AN/A1010N/AN/AN/AN/A
1263*=NetSupport Client_deleteme*.{0,1000}\=NetSupport\sClient_deleteme.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10#registryN/A1010N/AN/AN/AN/A
1264*>Anyplace Control Software<*.{0,1000}\>Anyplace\sControl\sSoftware\<.{0,1000}greyware_tool_keywordAnyplaceControlaccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyplace-control[.]com10N/AN/A1010N/AN/AN/AN/A
1265*>AnyViewer Setup<*.{0,1000}\>AnyViewer\sSetup\<.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A
1266*>AnyViewer<*.{0,1000}\>AnyViewer\<.{0,1000}greyware_tool_keywordanyvieweraccess your unattended PC from anywhereT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMwww.anyviewer.com10N/AN/A1010N/AN/AN/AN/A
1267*>Atera Networks<*.{0,1000}\>Atera\sNetworks\<.{0,1000}greyware_tool_keywordAteracontrol remote machines- abused by threat actorsT1021.001 - T1078 - T1133 - T1112TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010N/ABlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - DispossessorRMMhttps://www.atera.com/10#companynameN/A1010N/AN/AN/AN/A
1268*>Auvik Networks Inc.<*.{0,1000}\>Auvik\sNetworks\sInc\.\<.{0,1000}greyware_tool_keywordauvikcloud-based network management softwareT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.auvik.com/10N/AN/A1010N/AN/AN/AN/A
1269*>AweRay Limited<*.{0,1000}\>AweRay\sLimited\<.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
1270*>AweRay Pte. Ltd.<*.{0,1000}\>AweRay\sPte\.\sLtd\.\<.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
1271*>AweSun.exe<*.{0,1000}\>AweSun\.exe\<.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
1272*>AweSun<*.{0,1000}\>AweSun\<.{0,1000}greyware_tool_keywordawerayall-in-one secure remote access control and support solutionT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMsun.aweray.com10N/AN/A1010N/AN/AN/AN/A
1273*>Barracuda MSP<*.{0,1000}\>Barracuda\sMSP\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
1274*>Barracuda Networks, Inc.*.{0,1000}\>Barracuda\sNetworks,\sInc\..{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
1275*>Barracuda RMM Setup AutoRun<*.{0,1000}\>Barracuda\sRMM\sSetup\sAutoRun\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
1276*>Barracuda RMM Setup<*.{0,1000}\>Barracuda\sRMM\sSetup\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
1277*>Barracuda RMM*<*.{0,1000}\>Barracuda\sRMM.{0,1000}\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
1278*>Bomgar Corporation</Data>*\>Bomgar\sCorporation\<\/Data\>.{0,1000}greyware_tool_keywordBomgarBomgar beyoundtrust Remote access software - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.beyondtrust.com/10N/AN/A1010N/AN/AN/AN/A
1279*>DWAgent<*.{0,1000}\>DWAgent\<.{0,1000}greyware_tool_keyworddwagentThe DWService to remotly control your machine - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/dwservice/agent10N/AN/A105446822023-03-22T08:45:16Z2019-01-23T10:40:24Z
1280*>Famatech Corp.<*.{0,1000}\>Famatech\sCorp\.\<.{0,1000}greyware_tool_keywordRadminRadmin is a remote control program that lets you work on another computer through your ownT1021 - T1076 - T1563TA0008 - TA0009 - TA0002N/AAkiraRMMhttps://www.radmin.com/download/10#companynameN/A1010N/AN/AN/AN/A
1281*>FleetDeck Inc<*.{0,1000}\>FleetDeck\sInc\<.{0,1000}greyware_tool_keywordfleetdmManage everything in one placeT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://github.com/fleetdm/fleet10#companynameN/A101031834372024-12-08T00:28:45Z2020-11-03T22:17:18Z
1282*>Installed Remote Utilities - Viewer.*.{0,1000}\>Installed\sRemote\sUtilities\s\-\sViewer\..{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1283*>Installed Remote Utilities Server.</*.{0,1000}\>Installed\sRemote\sUtilities\sServer\.\<\/.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1284*>Level Software, Inc.<*.{0,1000}\>Level\sSoftware,\sInc\.\<.{0,1000}greyware_tool_keywordlevel.ioLevel is reinventing remote monitoring and managementT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AScattered Spider*RMMhttps://level.io/10N/AN/A1010N/AN/AN/AN/A
1285*>LPI Level Platforms<*.{0,1000}\>LPI\sLevel\sPlatforms\<.{0,1000}greyware_tool_keywordBarracudaRMMDeliver remote support services - formely AVGT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://www.barracudamsp.com/products/rmm/barracuda-rmm10N/AN/A1010N/AN/AN/AN/A
1286*>Mesh Agent background service<*.{0,1000}\>Mesh\sAgent\sbackground\sservice\<.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
1287*>Mesh Agent Company<*.{0,1000}\>Mesh\sAgent\sCompany\<.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
1288*>meshagentRepair<*.{0,1000}\>meshagentRepair\<.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
1289*>MeshCentral Agent<*.{0,1000}\>MeshCentral\sAgent\<.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
1290*>MeshCentral<*.{0,1000}\>MeshCentral\<.{0,1000}greyware_tool_keywordmeshcentralMeshCentral is a full computer management web site - abused by attackersT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMhttps://github.com/Ylianst/MeshCentral10N/AN/A101043495812024-12-07T14:41:24Z2017-08-28T16:21:11Z
1291*>NetSupport Client Application</*.{0,1000}\>NetSupport\sClient\sApplication\<\/.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1292*>NETSUPPORT LTD.</*.{0,1000}\>NETSUPPORT\sLTD\.\<\/.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1293*>NetSupport Ltd</*.{0,1000}\>NetSupport\sLtd\<\/.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1294*>NetSupport Remote Control</*.{0,1000}\>NetSupport\sRemote\sControl\<\/.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1295*>NetSupport remote Control</*.{0,1000}\>NetSupport\sremote\sControl\<\/.{0,1000}greyware_tool_keywordNetSupportNetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused by adversaries for remote system control and surveillanceT1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/ACuba - EvilCorp* - Black Basta - MoskalvzapoeRMMhttps://www.netsupportmanager.com/10N/AN/A1010N/AN/AN/AN/A
1296*>Product: Remote Utilities - Viewer -- *.{0,1000}\>Product\:\sRemote\sUtilities\s\-\sViewer\s\-\-\s.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1297*>Product: Remote Utilities Server -- *.{0,1000}\>Product\:\sRemote\sUtilities\sServer\s\-\-\s.{0,1000}greyware_tool_keywordRemoteUtilitiesRemoteUtilities Remote Access softwaresT1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090TA0003 - TA0008 - TA0011N/ARagnarLocker - MuddyWater - UAC-0050RMMhttps://www.remoteutilities.com/10N/AN/A1010N/AN/AN/AN/A
1298*>Quick Assist Component<*.{0,1000}\>Quick\sAssist\sComponent\<.{0,1000}greyware_tool_keywordQuickAssistSharing remote desktop with Microsoft Quick assitT1021 - T1071 - T1090TA0003 - TA0008 - TA0011LokiBotBlack BastaRMMhttps://apps.microsoft.com/detail/9p7bp5vnwkx510N/AQuick assist could be preinstalled in some Windows versions1010N/AN/AN/AN/A
1299*>RealVNC<*.{0,1000}\>RealVNC\<.{0,1000}greyware_tool_keywordvncviewerVNCViewer is an RMM tool that has been exploited by attackers to gain unauthorized remote access T1021 - T1071 - T1090TA0003 - TA0008 - TA0011N/AN/ARMMN/A10N/AN/A1010N/AN/AN/AN/A
The file is too large to be shown. View Raw
Reference in New Issue View Git Blame Copy Permalink