Potentially Suspicious File Creation by OpenEDR's ITSMService (via file_event)

title: Potentially Suspicious File Creation by OpenEDR's ITSMService (via file_event)
id: fd1ddc1f-5a34-518c-b1d6-b453c954401f
status: stable
description: This rule detects the creation of potentially anomalous files by OpenEDR's ITSMService process. The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features. While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or hostile file deployment.
author: 'Huntrule Team'
date: 2026-04-26
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://attack.mitre.org/techniques/T1570/
    - https://attack.mitre.org/techniques/T1105/
    - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.lateral-movement
    - attack.t1570
    - attack.t1219
logsource:
    product: windows
    category: file_event
detection:
    selection_process:
        Image|endswith: '\COMODO\Endpoint Manager\ITSMService.exe'
    selection_suspicious_extensions:
        TargetFilename|endswith:
            - '.7z'
            - '.bat'
            - '.cmd'
            - '.com'
            - '.dll'
            - '.exe'
            - '.hta'
            - '.js'
            - '.pif'
            - '.ps1'
            - '.rar'
            - '.scr'
            - '.vbe'
            - '.vbs'
            - '.zip'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium