AnyViewer RMM Remote Session Executes cmd.exe via AVCore.exe

Alerts when AnyViewer’s AVCore.exe launches cmd.exe with -d in a remote management context.

FreeUnreviewedSigmamediumv1

anyviewer-rmm-remote-session-executes-cmd-exe-via-avcore-exe-bc533330

title: AnyViewer RMM Remote Session Executes cmd.exe via AVCore.exe
id: d697f8a6-7fa8-4ad2-bcf9-a418f42a08db
status: test
description: This rule flags process creation where cmd.exe is started with AVCore.exe as the parent process, specifically when AVCore.exe is invoked with the -d parameter by AnyViewer. Attackers abusing remote management tools often execute system commands on endpoints to run payloads or further their access. The detection relies on Windows process creation telemetry, including the process image path and parent process command line details.
references:
  - https://www.anyviewer.com/help/remote-technical-support.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_anyviewer_shell_exec.yml
author: "@kostastsale, Huntrule Team"
date: 2024-08-03
tags:
  - attack.execution
  - attack.persistence
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \AVCore.exe
    ParentCommandLine|contains: AVCore.exe" -d
    Image|endswith: \cmd.exe
  condition: selection
falsepositives:
  - Legitimate use for admin activity.
level: medium
license: DRL-1.1
related:
  - id: bc533330-fc29-44c0-b245-7dc6e5939c87
    type: derived

What it detects

This rule flags process creation where cmd.exe is started with AVCore.exe as the parent process, specifically when AVCore.exe is invoked with the -d parameter by AnyViewer. Attackers abusing remote management tools often execute system commands on endpoints to run payloads or further their access. The detection relies on Windows process creation telemetry, including the process image path and parent process command line details.

Known false positives

Legitimate use for admin activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.