Windows: TacticalRMM Agent Installed with API/Auth Flags Pointing to Remote RMM Server

Alerts when TacticalRMM agent starts with --api/--auth and identity flags consistent with connecting to a configured remote RMM server.

FreeUnreviewedSigmamediumv1

windows-tacticalrmm-agent-installed-with-api-auth-flags-pointing-to-remote-rmm-s-2db93a3f

title: "Windows: TacticalRMM Agent Installed with API/Auth Flags Pointing to Remote RMM Server"
id: c1abb46b-7077-4ecc-a6c1-2cf6660a1f56
status: experimental
description: This rule flags process creations where the TacticalRMM agent executable is launched with command-line parameters that include --api, --auth, and related identity flags such as --client-id and --site-id. Those flags indicate the agent is being configured to authenticate and connect to a specified remote RMM server. This matters because configuring an agent for silent remote management can be abused to establish command-and-control through attacker-controlled infrastructure. The detection relies on Windows process creation telemetry containing the executable path and full command line arguments.
references:
  - https://github.com/amidaware/tacticalrmm
  - https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.yml
author: Ahmed Nosir (@egycondor), Huntrule Team
date: 2025-05-29
tags:
  - attack.command-and-control
  - attack.t1219
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: \TacticalAgent\tacticalrmm.exe
    CommandLine|contains|all:
      - --api
      - --auth
      - --client-id
      - --site-id
      - --agent-type
  condition: selection
falsepositives:
  - Legitimate system administrator deploying TacticalRMM
level: medium
license: DRL-1.1
related:
  - id: 2db93a3f-3249-4f73-9e68-0e77a0f8ae7e
    type: derived

What it detects

This rule flags process creations where the TacticalRMM agent executable is launched with command-line parameters that include --api, --auth, and related identity flags such as --client-id and --site-id. Those flags indicate the agent is being configured to authenticate and connect to a specified remote RMM server. This matters because configuring an agent for silent remote management can be abused to establish command-and-control through attacker-controlled infrastructure. The detection relies on Windows process creation telemetry containing the executable path and full command line arguments.

Known false positives

Legitimate system administrator deploying TacticalRMM

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.