From 988fd0f1e424e886363dfcdac9a62e63a6822e2b Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 07:52:12 -0500
Subject: [PATCH 01/19] Update detect_remote_access_software_usage_dns.yml

---
 .../network/detect_remote_access_software_usage_dns.yml       | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml
index e01bd31544..2f09884750 100644
--- a/detections/network/detect_remote_access_software_usage_dns.yml
+++ b/detections/network/detect_remote_access_software_usage_dns.yml
@@ -52,6 +52,10 @@ drilldown_searches:
     | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+- name: Investigate traffic to $query$ 
+  search: '| from datamodel:Network_Resolution.DNS | search src=$src$ query=$query$'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 rba:
   message: A domain for a known remote access software $query$ was contacted by $src$.
   risk_objects:

From d73c82d75f080b46b02e2ae137b2d273d715aedf Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 07:53:20 -0500
Subject: [PATCH 02/19] Add files via upload

---
 ...ote_monitoring_and_management_software.yml | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 stories/remote_monitoring_and_management_software.yml

diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml
new file mode 100644
index 0000000000..6027d0d472
--- /dev/null
+++ b/stories/remote_monitoring_and_management_software.yml
@@ -0,0 +1,20 @@
+name: Remote Monitoring and Management Software
+id: e405907a-273c-41c9-928c-768c9355c1f7
+version: 1
+date: '2035-01-14'
+author: Steven Dick
+description: Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM).
+narrative: Attackers can leverage a variety of 3rd party software to establish unapproved remote access or c2 channels to an enterprise network. Common techniques include the installation of these remote access software via channels via phishing, scam, or driveby malware compromise situations. While this Analytic Story is not a comprehensive listing of all RMM software it provides a useful starting point for well known indicators.
+references:
+- https://attack.mitre.org/techniques/T1219/
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
+tags:
+  category:
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring
\ No newline at end of file

From 8b0bf13a10b1eef289f67837e0fc76249c898658 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 07:53:56 -0500
Subject: [PATCH 03/19] Update detect_remote_access_software_usage_dns.yml

---
 detections/network/detect_remote_access_software_usage_dns.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml
index 2f09884750..d7501d2270 100644
--- a/detections/network/detect_remote_access_software_usage_dns.yml
+++ b/detections/network/detect_remote_access_software_usage_dns.yml
@@ -71,6 +71,7 @@ tags:
   - Command And Control
   - Ransomware
   - CISA AA24-241A
+  - Remote Monitoring and Management Software
   asset_type: Endpoint
   mitre_attack_id:
   - T1219

From db40375a6b7e0d532d66615ffc43b154df0f07e5 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 07:55:50 -0500
Subject: [PATCH 04/19] Update detect_remote_access_software_usage_traffic.yml

---
 .../detect_remote_access_software_usage_traffic.yml   | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml
index aeb0b45f21..26c57fe5b8 100644
--- a/detections/network/detect_remote_access_software_usage_traffic.yml
+++ b/detections/network/detect_remote_access_software_usage_traffic.yml
@@ -1,6 +1,6 @@
 name: Detect Remote Access Software Usage Traffic
 id: 885ea672-07ee-475a-879e-60d28aa5dd42
-version: 5
+version: 6
 date: '2024-11-15'
 author: Steven Dick
 status: production
@@ -52,6 +52,10 @@ drilldown_searches:
     | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+- name: Investigate application traffic for $app$ 
+  search: '| from datamodel:Network_Traffic.All_Traffic | search src=$src$ app=$app$'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 rba:
   message: Application traffic for a known remote access software [$signature$] was
     detected from $src$.
@@ -59,12 +63,15 @@ rba:
   - field: src
     type: system
     score: 25
-  threat_objects: []
+  threat_objects:
+  - field: signature
+    type: signature
 tags:
   analytic_story:
   - Insider Threat
   - Command And Control
   - Ransomware
+  - Remote Monitoring and Management Software
   asset_type: Network
   mitre_attack_id:
   - T1219

From 2447329ea9bec889c7cb3e0e5b9de1b83812b71a Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 07:56:12 -0500
Subject: [PATCH 05/19] Update detect_remote_access_software_usage_dns.yml

---
 detections/network/detect_remote_access_software_usage_dns.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml
index d7501d2270..73c0110bc3 100644
--- a/detections/network/detect_remote_access_software_usage_dns.yml
+++ b/detections/network/detect_remote_access_software_usage_dns.yml
@@ -1,6 +1,6 @@
 name: Detect Remote Access Software Usage DNS
 id: a16b797d-e309-41bd-8ba0-5067dae2e4be
-version: 5
+version: 6
 date: '2024-11-15'
 author: Steven Dick
 status: production

From 7773664924de1d4f222c5e7252bdf27b10190c17 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 07:57:46 -0500
Subject: [PATCH 06/19] Update detect_remote_access_software_usage_url.yml

---
 detections/web/detect_remote_access_software_usage_url.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml
index 4e51d42198..f47dee1569 100644
--- a/detections/web/detect_remote_access_software_usage_url.yml
+++ b/detections/web/detect_remote_access_software_usage_url.yml
@@ -1,6 +1,6 @@
 name: Detect Remote Access Software Usage URL
 id: 9296f515-073c-43a5-88ec-eda5a4626654
-version: 6
+version: 7
 date: '2024-11-15'
 author: Steven Dick
 status: production
@@ -52,6 +52,10 @@ drilldown_searches:
     by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+- name: Investigate traffic to $url_domain$ 
+  search: '| from datamodel:Web | search src=$src$ url_domain=$url_domain$'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 rba:
   message: A domain for a known remote access software $url_domain$ was contacted
     by $src$.
@@ -71,6 +75,7 @@ tags:
   - Command And Control
   - Ransomware
   - CISA AA24-241A
+  - Remote Monitoring and Management Software
   asset_type: Network
   mitre_attack_id:
   - T1219

From dea4448a4f3f800357cb682facc5287dfb791c3d Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 07:58:47 -0500
Subject: [PATCH 07/19] Update detect_remote_access_software_usage_file.yml

---
 .../endpoint/detect_remote_access_software_usage_file.yml  | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml
index a9d1005364..8dd08118de 100644
--- a/detections/endpoint/detect_remote_access_software_usage_file.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_file.yml
@@ -1,6 +1,6 @@
 name: Detect Remote Access Software Usage File
 id: 3bf5541a-6a45-4fdc-b01d-59b899fff961
-version: 5
+version: 6
 date: '2024-11-13'
 author: Steven Dick
 status: production
@@ -54,6 +54,10 @@ drilldown_searches:
     by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+- name: Investigate files on $dest$ 
+  search: '| from datamodel:Endpoint.Filesystem | search dest=$dest$ file_name=$file_name$'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 rba:
   message: A file for known a remote access software [$file_name$] was created on
     $dest$ by $user$.
@@ -74,6 +78,7 @@ tags:
   - Ransomware
   - Gozi Malware
   - CISA AA24-241A
+  - Remote Monitoring and Management Software
   asset_type: Endpoint
   mitre_attack_id:
   - T1219

From 38af78103f4f9ea2895dfd36a11ecb29f4c80f8c Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:00:27 -0500
Subject: [PATCH 08/19] Update detect_remote_access_software_usage_fileinfo.yml

---
 .../detect_remote_access_software_usage_fileinfo.yml   | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
index 8286572d72..f62fa7e159 100644
--- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
@@ -1,6 +1,6 @@
 name: Detect Remote Access Software Usage FileInfo
 id: ccad96d7-a48c-4f13-8b9c-9f6a31cba454
-version: 5
+version: 6
 date: '2024-11-13'
 author: Steven Dick
 status: production
@@ -47,6 +47,10 @@ drilldown_searches:
     | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+- name: Investigate processes on $dest$ 
+  search: '| from datamodel:Endpoint.Processes| search dest=$dest$ process_name=$process_name$'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 rba:
   message: A file attributes for known a remote access software [$process_name$] was
     detected on $dest$
@@ -54,6 +58,9 @@ rba:
   - field: dest
     type: system
     score: 25
+  - field: user
+    type: user
+    score: 25    
   threat_objects:
   - field: process_name
     type: process_name
@@ -63,6 +70,7 @@ tags:
   - Command And Control
   - Ransomware
   - Gozi Malware
+  - Remote Monitoring and Management Software
   asset_type: Endpoint
   mitre_attack_id:
   - T1219

From 778d7fa7cd4d3031216339eddea988ca34723ee7 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:01:53 -0500
Subject: [PATCH 09/19] Update detect_remote_access_software_usage_process.yml

---
 .../detect_remote_access_software_usage_process.yml      | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_remote_access_software_usage_process.yml b/detections/endpoint/detect_remote_access_software_usage_process.yml
index 8a5dfd6d64..e0417a4071 100644
--- a/detections/endpoint/detect_remote_access_software_usage_process.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_process.yml
@@ -1,6 +1,6 @@
 name: Detect Remote Access Software Usage Process
 id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
-version: 5
+version: 6
 date: '2024-11-13'
 author: Steven Dick
 status: production
@@ -59,6 +59,10 @@ drilldown_searches:
     by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
+- name: Investigate processes on $dest$ 
+  search: '| from datamodel:Endpoint.Processes| search dest=$dest$ process_name=$process_name$'
+  earliest_offset: $info_min_time$
+  latest_offset: $info_max_time$
 rba:
   message: A process for a known remote access software $process_name$ was identified
     on $dest$.
@@ -72,6 +76,8 @@ rba:
   threat_objects:
   - field: process_name
     type: process_name
+  - field: signature
+    type: signature
 tags:
   analytic_story:
   - Insider Threat
@@ -79,6 +85,7 @@ tags:
   - Ransomware
   - Gozi Malware
   - CISA AA24-241A
+  - Remote Monitoring and Management Software
   asset_type: Endpoint
   mitre_attack_id:
   - T1219

From b85aacf75fcdfc50830560f4432970b4f98575e0 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:02:38 -0500
Subject: [PATCH 10/19] Update detect_remote_access_software_usage_registry.yml

---
 .../endpoint/detect_remote_access_software_usage_registry.yml  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_remote_access_software_usage_registry.yml b/detections/endpoint/detect_remote_access_software_usage_registry.yml
index 93e927f108..a757b157c9 100644
--- a/detections/endpoint/detect_remote_access_software_usage_registry.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_registry.yml
@@ -1,6 +1,6 @@
 name: Detect Remote Access Software Usage Registry
 id: 33804986-25dd-43cf-bb6b-dc14956c7cbc
-version: 2
+version: 3
 date: '2025-01-10'
 author: Steven Dick
 status: production
@@ -60,6 +60,7 @@ tags:
   - Ransomware
   - Gozi Malware
   - CISA AA24-241A
+  - Remote Monitoring and Management Software
   asset_type: Endpoint
   mitre_attack_id: 
   - T1219

From f4a78d9f60130d2f1d7e8e4c5911f3e623bc7c52 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:03:25 -0500
Subject: [PATCH 11/19] Update detect_remote_access_software_usage_fileinfo.yml

---
 .../endpoint/detect_remote_access_software_usage_fileinfo.yml   | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
index f62fa7e159..b1a9ef4f84 100644
--- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
@@ -64,6 +64,8 @@ rba:
   threat_objects:
   - field: process_name
     type: process_name
+  - field: signature
+    type: signature
 tags:
   analytic_story:
   - Insider Threat

From 0885f557bb491b2bf881523f20c5d453eb8fe9ca Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:03:56 -0500
Subject: [PATCH 12/19] Update detect_remote_access_software_usage_file.yml

---
 .../endpoint/detect_remote_access_software_usage_file.yml       | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml
index 8dd08118de..25292e24c2 100644
--- a/detections/endpoint/detect_remote_access_software_usage_file.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_file.yml
@@ -71,6 +71,8 @@ rba:
   threat_objects:
   - field: file_name
     type: file_name
+  - field: signature
+    type: signature
 tags:
   analytic_story:
   - Insider Threat

From 41c92476b9714ab9d8375bc835633ec296f5f540 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:04:38 -0500
Subject: [PATCH 13/19] Update detect_remote_access_software_usage_url.yml

---
 detections/web/detect_remote_access_software_usage_url.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml
index f47dee1569..6f186e9379 100644
--- a/detections/web/detect_remote_access_software_usage_url.yml
+++ b/detections/web/detect_remote_access_software_usage_url.yml
@@ -69,6 +69,8 @@ rba:
   threat_objects:
   - field: url_domain
     type: domain
+  - field: signature
+    type: signature    
 tags:
   analytic_story:
   - Insider Threat

From 8d3da805575c3cb0f894ab6e9dbfbfad8d718891 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:05:27 -0500
Subject: [PATCH 14/19] Update detect_remote_access_software_usage_dns.yml

---
 detections/network/detect_remote_access_software_usage_dns.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml
index 73c0110bc3..8da3b18104 100644
--- a/detections/network/detect_remote_access_software_usage_dns.yml
+++ b/detections/network/detect_remote_access_software_usage_dns.yml
@@ -65,6 +65,8 @@ rba:
   threat_objects:
   - field: query
     type: domain
+  - field: signature
+    type: signature
 tags:
   analytic_story:
   - Insider Threat

From f5160eba6f4a2ad441dd303420e75986dbb83510 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:06:29 -0500
Subject: [PATCH 15/19] Update detect_remote_access_software_usage_traffic.yml

---
 .../network/detect_remote_access_software_usage_traffic.yml    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/detections/network/detect_remote_access_software_usage_traffic.yml b/detections/network/detect_remote_access_software_usage_traffic.yml
index 26c57fe5b8..526fe6f906 100644
--- a/detections/network/detect_remote_access_software_usage_traffic.yml
+++ b/detections/network/detect_remote_access_software_usage_traffic.yml
@@ -63,6 +63,9 @@ rba:
   - field: src
     type: system
     score: 25
+  - field: user
+    type: user
+    score: 25    
   threat_objects:
   - field: signature
     type: signature

From ef5eca5bd17ceb4327a9977280d2b7d4ab2c85ee Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:07:31 -0500
Subject: [PATCH 16/19] Update detect_remote_access_software_usage_dns.yml

---
 detections/network/detect_remote_access_software_usage_dns.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/network/detect_remote_access_software_usage_dns.yml b/detections/network/detect_remote_access_software_usage_dns.yml
index 8da3b18104..f7744a4f63 100644
--- a/detections/network/detect_remote_access_software_usage_dns.yml
+++ b/detections/network/detect_remote_access_software_usage_dns.yml
@@ -61,7 +61,7 @@ rba:
   risk_objects:
   - field: src
     type: system
-    score: 4
+    score: 25
   threat_objects:
   - field: query
     type: domain

From 911ebe61fd3062f4f7e2db8e54e217f3a9be20c7 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:18:05 -0500
Subject: [PATCH 17/19] Update remote_monitoring_and_management_software.yml

---
 stories/remote_monitoring_and_management_software.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml
index 6027d0d472..8050fdefc7 100644
--- a/stories/remote_monitoring_and_management_software.yml
+++ b/stories/remote_monitoring_and_management_software.yml
@@ -3,8 +3,12 @@ id: e405907a-273c-41c9-928c-768c9355c1f7
 version: 1
 date: '2035-01-14'
 author: Steven Dick
-description: Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM).
-narrative: Attackers can leverage a variety of 3rd party software to establish unapproved remote access or c2 channels to an enterprise network. Common techniques include the installation of these remote access software via channels via phishing, scam, or driveby malware compromise situations. While this Analytic Story is not a comprehensive listing of all RMM software it provides a useful starting point for well known indicators.
+description: |-
+  Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM).
+narrative: |-
+  Attackers can leverage a variety of 3rd party software to establish unapproved remote access or c2 channels to an enterprise network. Common techniques include the installation of these remote access software via channels via phishing, scam, or driveby malware compromise situations. While this Analytic Story is not a comprehensive listing of all RMM software it provides a useful starting point for well known indicators.
+  
+  Be sure to leverage the "RMM Software Tracking" dashboard provided with this story for a convienent way to vizualize RMM usage in your enviroment.
 references:
 - https://attack.mitre.org/techniques/T1219/
 - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
@@ -17,4 +21,4 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  usecase: Security Monitoring
\ No newline at end of file
+  usecase: Security Monitoring

From 30edc65d040d38391805027db661db136b9c19a9 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:18:27 -0500
Subject: [PATCH 18/19] Update remote_monitoring_and_management_software.yml

---
 stories/remote_monitoring_and_management_software.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml
index 8050fdefc7..d49b11948a 100644
--- a/stories/remote_monitoring_and_management_software.yml
+++ b/stories/remote_monitoring_and_management_software.yml
@@ -1,7 +1,7 @@
 name: Remote Monitoring and Management Software
 id: e405907a-273c-41c9-928c-768c9355c1f7
 version: 1
-date: '2035-01-14'
+date: '2025-01-14'
 author: Steven Dick
 description: |-
   Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM).

From 9658514c13464dab6ea8aca00c701f3701119568 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 08:24:08 -0500
Subject: [PATCH 19/19] Update remote_monitoring_and_management_software.yml

---
 stories/remote_monitoring_and_management_software.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml
index d49b11948a..f76cde7141 100644
--- a/stories/remote_monitoring_and_management_software.yml
+++ b/stories/remote_monitoring_and_management_software.yml
@@ -3,6 +3,7 @@ id: e405907a-273c-41c9-928c-768c9355c1f7
 version: 1
 date: '2025-01-14'
 author: Steven Dick
+status: production
 description: |-
   Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM).
 narrative: |-