Windows Service Installation: TacticalRMM Agent Service (SCM Event 7045)
Flags Windows service installations that include tacticalrmm.exe and the TacticalRMM Agent Service using SCM Event ID 7045.
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-28
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies Windows service installations where the Service Control Manager logs event ID 7045 and the created service references tacticalrmm.exe. It targets creation of the "TacticalRMM Agent Service", which remote monitoring tools commonly use but can also be abused for persistence and remote access. The detection relies on Windows System logs capturing service installation details, including the provider name, service name, and image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Service Installation: TacticalRMM Agent Service (SCM Event 7045)"
id: c132fd82-c436-4dd4-b9e9-71f5c74ffb3b
status: test
description: This rule identifies Windows service installations where the Service Control Manager logs event ID 7045 and the created service references tacticalrmm.exe. It targets creation of the "TacticalRMM Agent Service", which remote monitoring tools commonly use but can also be abused for persistence and remote access. The detection relies on Windows System logs capturing service installation details, including the provider name, service name, and image path.
references:
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_tacticalrmm.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-28
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
service: system
detection:
selection_root:
Provider_Name: Service Control Manager
EventID: 7045
selection_service:
- ImagePath|contains: tacticalrmm.exe
- ServiceName|contains: TacticalRMM Agent Service
condition: all of selection_*
falsepositives:
- Legitimate use of the tool
level: medium
license: DRL-1.1
related:
- id: 4bb79b62-ef12-4861-981d-2aab43fab642
type: derived