Sigma detection rules, expert-reviewed

Suspicious Remote Access Tool User Agent in Outbound Traffic via Proxy

This rule detects outbound HTTP requests carrying the NetSupport Manager or JWrapperDownloader user agents, network fingerprints of remote access tooling used during intrusions. Because these agents accompany download and command-and-control traffic for tools frequently abused as RATs, their presence in proxy logs indicates remote access tool activity that should be validated against sanctioned software.

Suspicious SimpleHelp Remote Access Tool Dropped In ProgramData Root

This rule detects the SimpleHelp remote-access binary access.exe executing from the root of the ProgramData directory, the drop location used by the actors exploiting CVE-2026-1731. Deploying a legitimate RMM tool from an unusual path gives the operator persistent hands-on access after exploitation. The ProgramData-root location distinguishes the malicious deployment from a normal install.

Suspicious AnyDesk Remote Access Tool Executed from ProgramData

This rule detects the AnyDesk remote access tool running from the C:\ProgramData directory, a deployment pattern used by threat actors targeting educational organizations to establish covert remote control as SYSTEM. Placing AnyDesk in ProgramData rather than its standard install path evades user notice. Unmanaged AnyDesk in this location indicates likely unauthorized remote access.

Silent AnyDesk Remote Access Tool Installation

This rule detects AnyDesk executed with an install flag, indicating an unattended deployment of the remote access tool. Huntress observed adversaries installing AnyDesk on compromised MSSQL servers to maintain hands-on access. Silent RMM installation on servers is a common attacker persistence and command-and-control technique that blends with legitimate remote support tooling.

Antivirus Remote Access Tool Signature Matches Known RAT Names

Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.

Windows MeshAgent Remote Access Tool Command Line Execution Indicators

Flags Windows processes invoking MeshAgent with --meshServiceName, indicating potential remote access tool execution.

macOS Process Creation: MeshAgent renamed execution via --meshServiceName

Identifies macOS executions of MeshAgent instances that include --meshServiceName, indicating potential renamed remote access tooling.

Windows SimpleService Execution via Remote Access Tool Wrapper Paths

Flags Windows processes running SimpleService.exe from remote access tool wrapper directories.

Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)

Flags Windows service installation or updates for remote access tool services using Service Control Manager events.

Windows Security Event 4697 Service Install of Remote Access Tools

Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.

Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling

Alerts on Windows process execution identified as “GoTo Opener” by LogMeIn, which may indicate remote access tool use.

Windows LogMeIn LMIGuardianSvc Execution Associated with Remote Access Tools

Flags Windows process launches identified as LogMeIn LMIGuardianSvc by Description/Product/Company attributes.