From d73c82d75f080b46b02e2ae137b2d273d715aedf Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Thu, 6 Feb 2025 07:53:20 -0500
Subject: [PATCH] Add files via upload

---
 ...ote_monitoring_and_management_software.yml | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 stories/remote_monitoring_and_management_software.yml

diff --git a/stories/remote_monitoring_and_management_software.yml b/stories/remote_monitoring_and_management_software.yml
new file mode 100644
index 0000000000..6027d0d472
--- /dev/null
+++ b/stories/remote_monitoring_and_management_software.yml
@@ -0,0 +1,20 @@
+name: Remote Monitoring and Management Software
+id: e405907a-273c-41c9-928c-768c9355c1f7
+version: 1
+date: '2035-01-14'
+author: Steven Dick
+description: Fortify your remote access and unapproved software monitoring with searches that monitor for and help you investigate the use of unappoved or malicious remote monitoring and management softwares (RMM).
+narrative: Attackers can leverage a variety of 3rd party software to establish unapproved remote access or c2 channels to an enterprise network. Common techniques include the installation of these remote access software via channels via phishing, scam, or driveby malware compromise situations. While this Analytic Story is not a comprehensive listing of all RMM software it provides a useful starting point for well known indicators.
+references:
+- https://attack.mitre.org/techniques/T1219/
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
+tags:
+  category:
+  - Malware
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring
\ No newline at end of file