Detection rules › Sigma

Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server

Severity
medium
Author
Ahmed Nosir (@egycondor)
Source
upstream

Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line. These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID. This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1105 Ingress Tool Transfer, T1219 Remote Access Tools

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

CommandLine|contains: --agent-type
CommandLine|contains: --api
CommandLine|contains: --auth
CommandLine|contains: --client-id
CommandLine|contains: --site-id
Image|contains: '\TacticalAgent\tacticalrmm.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • --agent-type
  • --api
  • --auth
  • --client-id
  • --site-id
Imagematch
  • \TacticalAgent\tacticalrmm.exe