Windows Suspicious File Creation by OpenEDR ITSMService.exe Using Executable/Archive Extensions

Alerts on Windows file creations by OpenEDR ITSMService.exe when the target ends with common executable or script/archive extensions.

FreeUnreviewedSigmamediumv1

windows-suspicious-file-creation-by-openedr-itsmservice-exe-using-executable-arc-9e4b7d3a

title: Windows Suspicious File Creation by OpenEDR ITSMService.exe Using Executable/Archive Extensions
id: fd119879-0488-44d4-bcd9-94d6ba224b6e
status: experimental
description: This rule flags file creation events where the creating process is OpenEDR's ITSMService.exe and the target filename ends with potentially executable or archive/script-related extensions. Attackers abusing remote management capabilities may stage payloads or deploy malicious files by writing these file types to disk. It relies on Windows file event telemetry that includes the process image path and the created/target filename.
author: "@kostastsale, Huntrule Team"
date: 2026-02-19
references:
  - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_comodo_itsm_potentially_suspicious_file_creation.yml
tags:
  - attack.command-and-control
  - attack.t1105
  - attack.lateral-movement
  - attack.t1570
  - attack.t1219
logsource:
  product: windows
  category: file_event
detection:
  selection_process:
    Image|endswith: \COMODO\Endpoint Manager\ITSMService.exe
  selection_suspicious_extensions:
    TargetFilename|endswith:
      - .7z
      - .bat
      - .cmd
      - .com
      - .dll
      - .exe
      - .hta
      - .js
      - .pif
      - .ps1
      - .rar
      - .scr
      - .vbe
      - .vbs
      - .zip
  condition: all of selection_*
falsepositives:
  - Legitimate OpenEDR file management operations
  - Authorized remote file uploads by IT administrators
  - Software deployment through OpenEDR console
level: medium
license: DRL-1.1
related:
  - id: 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d
    type: derived

What it detects

This rule flags file creation events where the creating process is OpenEDR's ITSMService.exe and the target filename ends with potentially executable or archive/script-related extensions. Attackers abusing remote management capabilities may stage payloads or deploy malicious files by writing these file types to disk. It relies on Windows file event telemetry that includes the process image path and the created/target filename.

Known false positives

Legitimate OpenEDR file management operations
Authorized remote file uploads by IT administrators
Software deployment through OpenEDR console

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.