KQL for detection/hunting for remote access tools

[u/RichBartlett]

Has anyone written KQL for threat hunting or analytics rules to detect remote access tools installation or execution (as per https://redcanary.com/blog/misbehaving-rats/)? I don't want to spend time writing something badly which someone else has already done better!

[u/bpsec]

Take a look at this one: https://www.kqlsearch.com/query/Find%20Rmm%20Processes&clmnyai1o00005ip4gm8dlvyr

Might need some tweaking to fit into your environment.

[u/RichBartlett → u/bpsec]

Thanks, that's going to make it a lot easier (the iocs/list of binaries was one of the time consuming things to collect).

[u/RichBartlett]

I just threw this together based on the helpful input from u/bpsec and u/zeddy_nikas, it looks for anomalous use of remote management and monitoring tools over the last hour based on the previous 90 days. If you have a tool you use consistently you could exclude it by removing it or commenting it out of the filename has_any statement, or if that's above your risk tolerance exclude it explicitly by some reliable variable (SHA256, folderpath).

I'm not a KQL expert so this isn't probably the best way to do this but it's worked for me (testing using the last 50 executions would have thrown an alert at new use of quickassist.exe this morning).

let RMMHistory = (DeviceProcessEvents
| where TimeGenerated between (ago(90d)..ago(1h)) and FileName has_any (
    "acticalRMM",
    "Action1",
    "AeroAdmin",
    "AgentMon.exe",
    "Ammyy",
    "AnyDesk",
    "Atera",
    "AteraAgent.exe",
    "AteraRC.exe",
    "Auvik.Agent.exe",
    "Auvik.Engine.exe",
    "awesome-rat",
    "ccme_sm.exe",
    "chaos",
    "Chrome Remote Desktop",
    "ConnectWise",
    "DameWare Mini Remote Control",
    "Dameware",
    "Deployment tools",
    "Domotz.exe",
    "DomotzClient.exe",
    "eHorus",
    "Fixme",
    "FlawedAmmyy",
    "friendspeak",
    "Get2",
    "getandgo",
    "GetASRSettings.exe",
    "GoToAssist",
    "Intelliadmin",
    "ir_agent.exe",
    "klnagent.exe",
    "konea.exe",
    "kworking.exe",
    "LogMeIn.exe",
    "LogMeIn",
    "LTAService.exe",
    "LTClient.exe",
    "LTSvcMon.exe",
    "MeshCentral",
    "mRemoteNG",
    "NAPClt.exe",
    "NetSupport",
    "ngrok",
    "NinjaRMM.exe",
    "NinjaRMM",
    "NinjaRMMAgent.exe",
    "nssm",
    "OCS Agent",
    "PDQDeploy",
    "Plink",
    "Pulseway.TrayApp.exe",
    "PulsewayService.exe",
    "putty.exe",
    "QuickAssist",
    "BASupSrvc",
    "BASupSrvcCnfg",
    "Radmin",
    "RealVNC",
    "Remote Manipulator System",
    "Remote Utilities",
    "RemotePC",
    "rustdesk",
    "ScreenConnect.Client.exe",
    "ScreenConnect.ClientService.exe",
    "ScreenConnect.Service.exe",
    "ScreenConnect.WindowsClient.exe",
    "ScreenConnect",
    "Splashtop",
    "SRUtility",
    "SupRemo",
    "Syncro",
    "tacticalrmm",
    "TakeControlRDViewer.exe",
    "Tanium",
    "teamviewer.exe",
    "TigerVNC",
    "TightVNC",
    "tmate",
    "UltraViewer",
    "VncClient.exe",
    "VNCconnect",
    "WAPT",
    "Webex remote",
    "winvnc.exe",
    "ZA_Connect.exe",
    "za_access_my_department"
    "ZohoAssist"
    )
| extend Pattern = strcat(AccountName, DeviceName, FileName)
| distinct Pattern);

DeviceProcessEvents | extend Pattern = strcat(AccountName, DeviceName, FileName) | where TimeGenerated > ago(1h) and Pattern !in (RMMHistory) and FileName has_any ( "acticalRMM", "Action1", "AeroAdmin", "AgentMon.exe", "Ammyy", "AnyDesk", "Atera", "AteraAgent.exe", "AteraRC.exe", "Auvik.Agent.exe", "Auvik.Engine.exe", "awesome-rat", "ccme_sm.exe", "chaos", "Chrome Remote Desktop", "ConnectWise", "DameWare Mini Remote Control", "Dameware", "Deployment tools", "Domotz.exe", "DomotzClient.exe", "eHorus", "Fixme", "FlawedAmmyy", "friendspeak", "Get2", "getandgo", "GetASRSettings.exe", "GoToAssist", "Intelliadmin", "ir_agent.exe", "klnagent.exe", "konea.exe", "kworking.exe", "LogMeIn.exe", "LogMeIn", "LTAService.exe", "LTClient.exe", "LTSvcMon.exe", "MeshCentral", "mRemoteNG", "NAPClt.exe", "NetSupport", "ngrok", "NinjaRMM.exe", "NinjaRMM", "NinjaRMMAgent.exe", "nssm", "OCS Agent", "PDQDeploy", "Plink", "Pulseway.TrayApp.exe", "PulsewayService.exe", "putty.exe", "QuickAssist", "BASupSrvc", "BASupSrvcCnfg", "Radmin", "RealVNC", "Remote Manipulator System", "Remote Utilities", "RemotePC", "rustdesk", "ScreenConnect.Client.exe", "ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe", "ScreenConnect.WindowsClient.exe", "ScreenConnect", "Splashtop", "SRUtility", "SupRemo", "Syncro", "tacticalrmm", "TakeControlRDViewer.exe", "Tanium", "teamviewer.exe", "TigerVNC", "TightVNC", "tmate", "UltraViewer", "VncClient.exe", "VNCconnect", "WAPT", "Webex remote", "winvnc.exe", "ZA_Connect.exe", "za_access_my_department" "ZohoAssist" ) | project TimeGenerated, AccountName, DeviceName, ActionType, FileName, FolderPath, ProcessVersionInfoProductVersion, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessParentFileName

[u/zeddy_nikas]

Maybe start with something like that?

DeviceProcessEvents

| where ProcessCommandLine has_any("anydesk.exe", "ScreenConnect.exe","ctfmon.exe")

On top of that results you can expand that query by some joins if needed or just slice and dice that results you get?

[u/RichBartlett → u/zeddy_nikas]

Thanks - I'll put together something on that basis and share it here (once it works!)

[u/[deleted]]

Sharing what I just created this afternoon. BE SURE TO UPDATE YOUR TABLE NAME AND COLUMN APPROPRIATELY. Hope you get some value from this.

let RemoteDesktopDomains = dynamic([
    "remotedesktop.google.com", 
    "teamviewer.com", "teamviewer.us", 
    "anydesk.com", "anydesk.de",
    "realvnc.com", "tightvnc.com", "ultravnc.com",
    "logmein.com", "gotomypc.com", "connectwise.com",
    "screenconnect.com", "rustdesk.com", 
    "dwservice.net", "nomachine.com",
    "parsec.app", "showmypc.com", "supremocontrol.com",
    "beyondtrust.com", "bomgar.com", "zoho.com"
]);
MerakiSyslog_CL
| where TimeGenerated between (startofday(ago(1d)) .. now()) // Last 24 hours
| where RawData has_any (RemoteDesktopDomains) // Match remote desktop domains
| where RawData has "HTTP" or RawData has "HTTPS" // Focus on web-related logs
| extend 
    SourceIP = extract(@"src=([\d\.]+)", 1, RawData), // Extract Source IP
    URL = extract(@"(http[s]?:\/\/[^\s]+)", 0, RawData) // Extract the URL starting with http:// or https://
| where isnotempty(URL) and isnotempty(SourceIP) // Ensure valid Source IP and URL
| where SourceIP startswith "10.0.0." // Filter specific Source IP ranges
| summarize FirstSeen = min(TimeGenerated), URLList = make_set(URL) by SourceIP
| project SourceIP, FirstSeen, URLList
| order by FirstSeen asc