Radmin Viewer Utility Execution on Windows (Process Creation)

title: Radmin Viewer Utility Execution on Windows (Process Creation)
id: ca4c9a01-f748-4015-b150-0981e990197a
status: test
description: This rule flags process creation events where the executable is identified as Radmin Viewer (Radmin.exe) via the Description, Product, and OriginalFileName fields. Radmin can be used for remote control of Windows machines, so its execution may indicate legitimate remote administration or malicious lateral movement. The detection relies on Windows process creation telemetry containing executable metadata.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md
  - https://www.radmin.fr/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_radmin.yml
author: frack113, Huntrule Team
date: 2022-01-22
modified: 2023-12-11
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1072
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: Radmin Viewer
    - Product: Radmin Viewer
    - OriginalFileName: Radmin.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 5817e76f-4804-41e6-8f1d-5fa0b3ecae2d
    type: derived