Every published rule

Antivirus Remote Access Tool Signature Matches Known RAT Names

Alerts on antivirus detections referencing multiple known RAT family signature names in the event signature field.

Windows MeshAgent Remote Access Tool Command Line Execution Indicators

Flags Windows processes invoking MeshAgent with --meshServiceName, indicating potential remote access tool execution.

macOS Process Creation: MeshAgent renamed execution via --meshServiceName

Identifies macOS executions of MeshAgent instances that include --meshServiceName, indicating potential renamed remote access tooling.

Windows SimpleService Execution via Remote Access Tool Wrapper Paths

Flags Windows processes running SimpleService.exe from remote access tool wrapper directories.

Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)

Flags Windows service installation or updates for remote access tool services using Service Control Manager events.

Windows Security Event 4697 Service Install of Remote Access Tools

Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.

Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling

Alerts on Windows process execution identified as “GoTo Opener” by LogMeIn, which may indicate remote access tool use.

Windows LogMeIn LMIGuardianSvc Execution Associated with Remote Access Tools

Flags Windows process launches identified as LogMeIn LMIGuardianSvc by Description/Product/Company attributes.