Radmin Viewer Utility Execution on Windows (Process Creation)
Alerts when Radmin Viewer (Radmin.exe) is launched, based on process metadata in Windows process creation logs.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-22
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where the executable is identified as Radmin Viewer (Radmin.exe) via the Description, Product, and OriginalFileName fields. Radmin can be used for remote control of Windows machines, so its execution may indicate legitimate remote administration or malicious lateral movement. The detection relies on Windows process creation telemetry containing executable metadata.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Radmin Viewer Utility Execution on Windows (Process Creation)
id: ca4c9a01-f748-4015-b150-0981e990197a
status: test
description: This rule flags process creation events where the executable is identified as Radmin Viewer (Radmin.exe) via the Description, Product, and OriginalFileName fields. Radmin can be used for remote control of Windows machines, so its execution may indicate legitimate remote administration or malicious lateral movement. The detection relies on Windows process creation telemetry containing executable metadata.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md
- https://www.radmin.fr/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_radmin.yml
author: frack113, Huntrule Team
date: 2022-01-22
modified: 2023-12-11
tags:
- attack.execution
- attack.lateral-movement
- attack.t1072
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: Radmin Viewer
- Product: Radmin Viewer
- OriginalFileName: Radmin.exe
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 5817e76f-4804-41e6-8f1d-5fa0b3ecae2d
type: derived