RMM_detection.csv

"keyword","metadata_keyword_regex","metadata_keyword_type","metadata_tool","metadata_description","metadata_tool_techniques","metadata_tool_tactics","metadata_malwares_name","metadata_groups_name","metadata_category","metadata_link","metadata_enable_endpoint_detection","metadata_enable_proxy_detection","metadata_tags","metadata_comment","metadata_severity_score","metadata_popularity_score","metadata_github_stars","metadata_github_forks","metadata_github_updated_at","metadata_github_created_at"
"* ./level-darwin-bundle-amd64.pkg*",".{0,1000}\s\.\/level\-darwin\-bundle\-amd64\.pkg.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"* ./level-linux-amd64 *",".{0,1000}\s\.\/level\-linux\-amd64\s.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"* ./level-linux-arm64 *",".{0,1000}\s\.\/level\-linux\-arm64\s.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"* /EV""NetSupport School""*",".{0,1000}\s\/EV\""NetSupport\sSchool\"".{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* /f /im RemotePCS*",".{0,1000}\s\/f\s\/im\sRemotePCS.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* /F /TN ""Level\Level Watchdog""*",".{0,1000}\s\/F\s\/TN\s\""Level\\Level\sWatchdog\"".{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* /monitor /from_service /cpu_memory_refresh * /disk_space_refresh * /proc_list_refresh * /semkey *",".{0,1000}\s\/monitor\s\/from_service\s\/cpu_memory_refresh\s.{0,1000}\s\/disk_space_refresh\s.{0,1000}\s\/proc_list_refresh\s.{0,1000}\s\/semkey\s.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* <Data>Received Request Run command *</Data>*",".{0,1000}\s\<Data\>Received\sRequest\sRun\scommand\s.{0,1000}\<\/Data\>.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* -a tcrmtshellagentmodule_*",".{0,1000}\s\-a\stcrmtshellagentmodule_.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"* aeroadmin.exe*",".{0,1000}\saeroadmin\.exe.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* -altgw *.zohoassist.com *",".{0,1000}\s\-altgw\s.{0,1000}\.zohoassist\.com\s.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* chrome-remote-desktop@*",".{0,1000}\schrome\-remote\-desktop\@.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* CN=Quasar Server CA*",".{0,1000}\sCN\=Quasar\sServer\sCA.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"* Connection #*. Connection to ""*"" established. Mode: <Remote control>.*",".{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\"".{0,1000}\""\sestablished\.\sMode\:\s\<Remote\scontrol\>\..{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#content","N/A","10","10","N/A","N/A","N/A","N/A"
"* Connection #*. Connection to ""*"". Security check - OK. Mode:  <Inventory manager>*",".{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\"".{0,1000}\""\.\sSecurity\scheck\s\-\sOK\.\sMode\:\s\s\<Inventory\smanager\>.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#content","N/A","10","10","N/A","N/A","N/A","N/A"
"* Connection #*. Connection to ""*"". Security check - OK. Mode: <Command (command: *)>",".{0,1000}\sConnection\s\#.{0,1000}\.\sConnection\sto\s\"".{0,1000}\""\.\sSecurity\scheck\s\-\sOK\.\sMode\:\s\<Command\s\(command\:\s.{0,1000}\)\>","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#content","N/A","10","10","N/A","N/A","N/A","N/A"
"* Connection #*. Direct connection to * (*:5650).*",".{0,1000}\sConnection\s\#.{0,1000}\.\sDirect\sconnection\sto\s.{0,1000}\s\(.{0,1000}\:5650\)\..{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#content","N/A","10","10","N/A","N/A","N/A","N/A"
"* create RPCService start=*",".{0,1000}\screate\sRPCService\sstart\=.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* create ViewerService start=auto*",".{0,1000}\screate\sViewerService\sstart\=auto.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* Dameware Mini Remote Control x64 -- Installation completed successfully*",".{0,1000}\sDameware\sMini\sRemote\sControl\sx64\s\-\-\sInstallation\scompleted\ssuccessfully.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"* downloads.level.io*",".{0,1000}\sdownloads\.level\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* DownloadServer=https://www.gotomypc.com *",".{0,1000}\sDownloadServer\=https\:\/\/www\.gotomypc\.com\s.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* gotoopener://launch.getgo.com/*",".{0,1000}\sgotoopener\:\/\/launch\.getgo\.com\/.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* -i remotepc.deb*",".{0,1000}\s\-i\sremotepc\.deb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* install meshcentral*",".{0,1000}\sinstall\smeshcentral.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"* install-fleetctl.sh*",".{0,1000}\sinstall\-fleetctl\.sh.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"* LoggingServer=logging.getgo.com ProxyHost=*",".{0,1000}\sLoggingServer\=logging\.getgo\.com\sProxyHost\=.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* -log-level trace -dre -log-path *",".{0,1000}\s\-log\-level\strace\s\-dre\s\-log\-path\s.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"* meshcentral.service*",".{0,1000}\smeshcentral\.service.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"* -ms assist.zoho.com -p 443*",".{0,1000}\s\-ms\sassist\.zoho\.com\s\-p\s443.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* -name:* -password:* -remoteexecute -filename*",".{0,1000}\s\-name\:.{0,1000}\s\-password\:.{0,1000}\s\-remoteexecute\s\-filename.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* -omeshcmd.exe -imodule1.js*",".{0,1000}\s\-omeshcmd\.exe\s\-imodule1\.js.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"* PCMonitorManager.exe*",".{0,1000}\sPCMonitorManager\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* PCMonitorSrv.exe*",".{0,1000}\sPCMonitorSrv\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* pcmontask.exe*",".{0,1000}\spcmontask\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* pulseway_x64.deb*",".{0,1000}\spulseway_x64\.deb.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* Pulseway_x64.msi*",".{0,1000}\sPulseway_x64\.msi.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* pulseway_x86.deb*",".{0,1000}\spulseway_x86\.deb.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* RemoteDesktop.exe*",".{0,1000}\sRemoteDesktop\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* RemotePC.exe*",".{0,1000}\sRemotePC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* RemotePCAttendedService *",".{0,1000}\sRemotePCAttendedService\s.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* remotepclauncher.exe*",".{0,1000}\sremotepclauncher\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* remotepcuiu.exe*",".{0,1000}\sremotepcuiu\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* RemotePCViewer.msi*",".{0,1000}\sRemotePCViewer\.msi.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* rmm-installer.ps1*",".{0,1000}\srmm\-installer\.ps1.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"* rpcdownloader.exe*",".{0,1000}\srpcdownloader\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* rpcperfviewer.exe*",".{0,1000}\srpcperfviewer\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* RPCWinXP.exe*",".{0,1000}\sRPCWinXP\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* -rr_flag * -group * -fileTransferGateways *.zohoassist.com -ADMINAGENT*",".{0,1000}\s\-rr_flag\s.{0,1000}\s\-group\s.{0,1000}\s\-fileTransferGateways\s.{0,1000}\.zohoassist\.com\s\-ADMINAGENT.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* RustDesk.exe*",".{0,1000}\sRustDesk\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"* SELECT ProcessId FROM Win32_Process * Name='ZAAudioClient.exe'*",".{0,1000}\sSELECT\sProcessId\sFROM\sWin32_Process\s.{0,1000}\sName\=\'ZAAudioClient\.exe\'.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* -service TightVNC Server*",".{0,1000}\s\-service\sTightVNC\sServer.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* start rustdesk://*",".{0,1000}\sstart\srustdesk\:\/\/.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"* start SupremoService*",".{0,1000}\sstart\sSupremoService.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* start uvnc_service*",".{0,1000}\sstart\suvnc_service.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* stop uvnc_service*",".{0,1000}\sstop\suvnc_service.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* Supremo.exe*",".{0,1000}\sSupremo\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* tacticalrmm.exe*",".{0,1000}\stacticalrmm\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"* tkc_agent_dre.deb*",".{0,1000}\stkc_agent_dre\.deb.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* ultravnc.ini *",".{0,1000}\sultravnc\.ini\s.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* upload*.systemmonitor.eu.com*/command/agentprocessor*",".{0,1000}\supload.{0,1000}\.systemmonitor\.eu\.com.{0,1000}\/command\/agentprocessor.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* vnc.ini *",".{0,1000}\svnc\.ini\s.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* VSAX_x64.msi*",".{0,1000}\sVSAX_x64\.msi.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* --webview-exe-name=QuickAssist.exe*",".{0,1000}\s\-\-webview\-exe\-name\=QuickAssist\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"* ZA_Connect.exe*",".{0,1000}\sZA_Connect\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* ZAAudioClient.exe*",".{0,1000}\sZAAudioClient\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* ZAFileTransfer.exe*",".{0,1000}\sZAFileTransfer\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"* ZAService.exe*",".{0,1000}\sZAService\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*""message"":""ably connection state: CONNECTED""}*",".{0,1000}\""message\""\:\""ably\sconnection\sstate\:\sCONNECTED\""\}.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*""publisher"":""uvnc bvba*",".{0,1000}\""publisher\""\:\""uvnc\sbvba.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry value","10","10","N/A","N/A","N/A","N/A"
"*""RemotePCAttendedService""*",".{0,1000}\""RemotePCAttendedService\"".{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*""SimpleHelp Remote Printer""*",".{0,1000}\""SimpleHelp\sRemote\sPrinter\"".{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*$env:LEVEL_API_KEY = ""*"";*",".{0,1000}\$env\:LEVEL_API_KEY\s\=\s\"".{0,1000}\""\;.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*$tempFile = Join-Path ([System.IO.Path]::GetTempPath()) ""install_windows.exe"";*",".{0,1000}\$tempFile\s\=\sJoin\-Path\s\(\[System\.IO\.Path\]\:\:GetTempPath\(\)\)\s\""install_windows\.exe\""\;.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.\TightVNC1*",".{0,1000}\.\\TightVNC1.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*.\TightVNC2*",".{0,1000}\.\\TightVNC2.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*.\TightVNC3*",".{0,1000}\.\\TightVNC3.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*.api.splashtop.com*",".{0,1000}\.api\.splashtop\.com.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.apitest.barracudamsp.com*",".{0,1000}\.apitest\.barracudamsp\.com.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.aweray.net*",".{0,1000}\.aweray\.net.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.beyondtrustcloud.com/session_complete*",".{0,1000}\.beyondtrustcloud\.com\/session_complete.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.chrome-remote-desktop-session*",".{0,1000}\.chrome\-remote\-desktop\-session.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.comodo.com/static/frontend/static-pages/enroll-wizard/token*",".{0,1000}\.comodo\.com\/static\/frontend\/static\-pages\/enroll\-wizard\/token.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.console.gotoassist.com*",".{0,1000}\.console\.gotoassist\.com.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.dev1.fleetdeck.io*",".{0,1000}\.dev1\.fleetdeck\.io.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*.exe --IPCport 5939 --Module 1*",".{0,1000}\.exe\s\-\-IPCport\s5939\s\-\-Module\s1.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","https://github.com/SigmaHQ/sigma/pull/4759","10","10","N/A","N/A","N/A","N/A"
"*.exe --pn dre_video_uploader --logpath logs*",".{0,1000}\.exe\s\-\-pn\sdre_video_uploader\s\-\-logpath\slogs.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.meshagent.pid*",".{0,1000}\.meshagent\.pid.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*.mspa.n-able.com*",".{0,1000}\.mspa\.n\-able\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.relay.splashtop.com*",".{0,1000}\.relay\.splashtop\.com.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.remotepc.com*",".{0,1000}\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.remotepc.com*",".{0,1000}\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","network","10","10","N/A","N/A","N/A","N/A"
"*.remoteutilities.com*",".{0,1000}\.remoteutilities\.com.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.remoteview.logmein.com*",".{0,1000}\.remoteview\.logmein\.com.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.router.teamviewer.com*",".{0,1000}\.router\.teamviewer\.com.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*.servicedesk.atera.com/GetAgent*",".{0,1000}\.servicedesk\.atera\.com\/GetAgent.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.vsax.net*",".{0,1000}\.vsax\.net.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.xeox.com*",".{0,1000}\.xeox\.com.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.zohoassist.com.cn*",".{0,1000}\.zohoassist\.com\.cn.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*.zohoassist.jp*",".{0,1000}\.zohoassist\.jp.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/.anydesk/.anydesk.trace*",".{0,1000}\/\.anydesk\/\.anydesk\.trace.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/.anydesk/service.conf*",".{0,1000}\/\.anydesk\/service\.conf.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/.anydesk/system.conf*",".{0,1000}\/\.anydesk\/system\.conf.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/.anydesk/user.conf*",".{0,1000}\/\.anydesk\/user\.conf.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/.fleetctl/fleetctl*",".{0,1000}\/\.fleetctl\/fleetctl.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*/action1_agent(My_Organization).msi*",".{0,1000}\/action1_agent\(My_Organization\)\.msi.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","product name","10","10","N/A","N/A","N/A","N/A"
"*/aeroadmin.exe*",".{0,1000}\/aeroadmin\.exe.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Agent/AcknowledgeCommands/*",".{0,1000}\/Agent\/AcknowledgeCommands\/.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Agent/GetCommandsFallback/*",".{0,1000}\/Agent\/GetCommandsFallback\/.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Agent/GetEnvironmentStatus/*",".{0,1000}\/Agent\/GetEnvironmentStatus\/.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Agent/GetRecurringPackages/*",".{0,1000}\/Agent\/GetRecurringPackages\/.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Alpemix.zip*",".{0,1000}\/Alpemix\.zip.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/amidaware/rmmagent/releases/download/*",".{0,1000}\/amidaware\/rmmagent\/releases\/download\/.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/Anydesk.exe",".{0,1000}\/Anydesk\.exe","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","1","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/anyplace-control/data2/*.exe*",".{0,1000}\/anyplace\-control\/data2\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/AnyViewerSetup.exe*",".{0,1000}\/AnyViewerSetup\.exe.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Apemix.exe*",".{0,1000}\/Apemix\.exe.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/api/latest/fleet/mdm/bootstrap?token=*",".{0,1000}\/api\/latest\/fleet\/mdm\/bootstrap\?token\=.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*/api/v1/fleet/mdm/sso/callback*",".{0,1000}\/api\/v1\/fleet\/mdm\/sso\/callback.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*/Applications/Anydesk.app/*",".{0,1000}\/Applications\/Anydesk\.app\/.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/Applications/Managed Workplace/Onsite Manager/logs/*",".{0,1000}\/Applications\/Managed\sWorkplace\/Onsite\sManager\/logs\/.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Assistance rapide Installer.exe*",".{0,1000}\/Assistance\srapide\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*/Assistenza rapida Installer.exe*",".{0,1000}\/Assistenza\srapida\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*/AttendedUDP.zip*",".{0,1000}\/AttendedUDP\.zip.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Aweray_Remote_*.exe*",".{0,1000}\/Aweray_Remote_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Aweray_Remote_*.zip*",".{0,1000}\/Aweray_Remote_.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/bin/meshagent*",".{0,1000}\/bin\/meshagent.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#linux","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/bin/MeshCommander*",".{0,1000}\/bin\/MeshCommander.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#linux","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/bomgar-rep.exe*",".{0,1000}\/bomgar\-rep\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/bomgar-rep-installer.exe*",".{0,1000}\/bomgar\-rep\-installer\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/bomgar-scc-*.exe*",".{0,1000}\/bomgar\-scc\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/bomgar-scc.exe*",".{0,1000}\/bomgar\-scc\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Create /TN TVInstallRestore /TR *",".{0,1000}\/Create\s\/TN\sTVInstallRestore\s\/TR\s.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*/damewareagent.exe*",".{0,1000}\/damewareagent\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/downloads/ultravnc.html*",".{0,1000}\/downloads\/ultravnc\.html.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/dwagent.desktop*",".{0,1000}\/dwagent\.desktop.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*/dwagent.service*",".{0,1000}\/dwagent\.service.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*/dwagsystray*",".{0,1000}\/dwagsystray.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*/DWMRC_St_64.msi*",".{0,1000}\/DWMRC_St_64\.msi.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*/DWRCC.exe*",".{0,1000}\/DWRCC\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*/DWRCCMD.exe*",".{0,1000}\/DWRCCMD\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*/DWRCS.exe*",".{0,1000}\/DWRCS\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*/etc/ehorus/ehorus_agent*",".{0,1000}\/etc\/ehorus\/ehorus_agent.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/etc/fleet/fleet.env*",".{0,1000}\/etc\/fleet\/fleet\.env.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#linux","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*/etc/init.d/ehorus_agent_daemon*",".{0,1000}\/etc\/init\.d\/ehorus_agent_daemon.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/etc/level/config.yaml*",".{0,1000}\/etc\/level\/config\.yaml.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"* /r /proxy  /proxyport  /proxyusername  /proxypasswd *",".{0,1000}\s\/r\s\/proxy\s\s\/proxyport\s\s\/proxyusername\s\s\/proxypasswd\s.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/etc/pulseway/config.xml*",".{0,1000}\/etc\/pulseway\/config\.xml.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/etc/systemd/system/anydesk.service*",".{0,1000}\/etc\/systemd\/system\/anydesk\.service.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","#linux","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*""appName"":""eHorus Agent""*",".{0,1000}\""appName\""\:\""eHorus\sAgent\"".{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"* /register  /proxy  /proxyport  /proxyusername  /proxypasswd*",".{0,1000}\s\/register\s\s\/proxy\s\s\/proxyport\s\s\/proxyusername\s\s\/proxypasswd.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ehorus_agent_installer-*",".{0,1000}\/ehorus_agent_installer\-.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/usr/sbin/userdel -r ehorus*",".{0,1000}\/usr\/sbin\/userdel\s\-r\sehorus.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/usr/share/ehorus*",".{0,1000}\/usr\/share\/ehorus.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\eHorus Agent Menu.lnk*",".{0,1000}\\eHorus\sAgent\sMenu\.lnk.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/fleet_v*_linux.tar.gz*",".{0,1000}\/fleet_v.{0,1000}_linux\.tar\.gz.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*/fleetd.crx*",".{0,1000}\/fleetd\.crx.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*/fleetdm/fleet/releases/download/*",".{0,1000}\/fleetdm\/fleet\/releases\/download\/.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*/fleetdm/fleet/releases/latest*",".{0,1000}\/fleetdm\/fleet\/releases\/latest.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*\eHorus Agent.lnk*",".{0,1000}\\eHorus\sAgent\.lnk.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus standalone.exe*",".{0,1000}\\ehorus\sstandalone\.exe.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus_agent.conf*",".{0,1000}\\ehorus_agent\.conf.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus_agent.exe*",".{0,1000}\\ehorus_agent\.exe.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus_agent.log*",".{0,1000}\\ehorus_agent\.log.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#logfile","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus_agent_disconn.log*",".{0,1000}\\ehorus_agent_disconn\.log.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#logfile","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus_cmd.exe*",".{0,1000}\\ehorus_cmd\.exe.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus_display.exe*",".{0,1000}\\ehorus_display\.exe.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus_installer_windows-*",".{0,1000}\\ehorus_installer_windows\-.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/home/*/.anydesk/*",".{0,1000}\/home\/.{0,1000}\/\.anydesk\/.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","#linux","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/home/user/rustdesk*",".{0,1000}\/home\/user\/rustdesk.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","#linux","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\ehorus_launcher.exe*",".{0,1000}\\ehorus_launcher\.exe.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/host-7.2.2.0.msi*",".{0,1000}\/host\-7\.2\.2\.0\.msi.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ehorus_uit.exe*",".{0,1000}\\ehorus_uit\.exe.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/HVNC.git*",".{0,1000}\/HVNC\.git.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","1","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*\eHorusMsiCustomActions.dll*",".{0,1000}\\eHorusMsiCustomActions\.dll.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Microsoft\Windows\Start Menu\Programs\eHorus Agent\*",".{0,1000}\\Microsoft\\Windows\\Start\sMenu\\Programs\\eHorus\sAgent\\.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\ehorus_agent\*",".{0,1000}\\Program\sFiles\\ehorus_agent\\.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/install-fleetctl.sh*",".{0,1000}\/install\-fleetctl\.sh.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*\SOFTWARE\eHorusDispl\*",".{0,1000}\\SOFTWARE\\eHorusDispl\\.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\System\CurrentControlSet\Services\ehorus*",".{0,1000}\\System\\CurrentControlSet\\Services\\ehorus.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#servicename #registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\System\CurrentControlSet\Services\EHORUSAGENT*",".{0,1000}\\System\\CurrentControlSet\\Services\\EHORUSAGENT.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#servicename #registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*>eHorus Agent Setup<*",".{0,1000}\>eHorus\sAgent\sSetup\<.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#description","N/A","10","10","N/A","N/A","N/A","N/A"
"*>EHORUSAGENT<*",".{0,1000}\>EHORUSAGENT\<.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#servicename","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://portal.ehorus.com/#/agents/*",".{0,1000}https\:\/\/portal\.ehorus\.com\/\#\/agents\/.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*hub.ehorus.com",".{0,1000}hub\.ehorus\.com","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc delete ehorus*",".{0,1000}sc\sdelete\sehorus.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc stop ehorus*",".{0,1000}sc\sstop\sehorus.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*switch.ehorus.com*",".{0,1000}switch\.ehorus\.com.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /F /IM ""ehorus_agent.exe""*",".{0,1000}taskkill\s\/F\s\/IM\s\""ehorus_agent\.exe\"".{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /F /IM ""ehorus_cmd.exe""*",".{0,1000}taskkill\s\/F\s\/IM\s\""ehorus_cmd\.exe\"".{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/level-windows-amd64.exe*",".{0,1000}\/level\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/level-windows-arm64.exe*",".{0,1000}\/level\-windows\-arm64\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /F /IM ""ehorus_display.exe""*",".{0,1000}taskkill\s\/F\s\/IM\s\""ehorus_display\.exe\"".{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*umount /usr/share/ehorus/.gvfs -r >/dev/null 2>&1*",".{0,1000}umount\s\/usr\/share\/ehorus\/\.gvfs\s\-r\s\>\/dev\/null\s2\>\&1.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*useradd -d /usr/share/ehorus -p * ehorus*",".{0,1000}useradd\s\-d\s\/usr\/share\/ehorus\s\-p\s.{0,1000}\sehorus.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Library/Logs/SPLog.txt*",".{0,1000}\/Library\/Logs\/SPLog\.txt.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/LMI_Rescue.exe*",".{0,1000}\/LMI_Rescue\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/LMIRTechConsole.exe*",".{0,1000}\/LMIRTechConsole\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/log/anydesk.trace*",".{0,1000}\/log\/anydesk\.trace.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/MeshAgent --*",".{0,1000}\/MeshAgent\s\-\-.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/MeshAgent.git*",".{0,1000}\/MeshAgent\.git.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","1","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*/MeshCentral.git*",".{0,1000}\/MeshCentral\.git.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/meshcentral.service*",".{0,1000}\/meshcentral\.service.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/meshinstall.sh*",".{0,1000}\/meshinstall\.sh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/meshinstall-bsd-rcd.sh*",".{0,1000}\/meshinstall\-bsd\-rcd\.sh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/nats-rmm.conf*",".{0,1000}\/nats\-rmm\.conf.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/nspowershell.exe*",".{0,1000}\/nspowershell\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/nssadmui.exe*",".{0,1000}\/nssadmui\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pcictlui.exe*",".{0,1000}\/pcictlui\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/PCIDEPLY.exe*",".{0,1000}\/PCIDEPLY\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/PCMonitorManager.exe*",".{0,1000}\/PCMonitorManager\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/PCMonitorSrv.exe*",".{0,1000}\/PCMonitorSrv\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pcmontask.exe*",".{0,1000}\/pcmontask\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pcmrdp-client.dll*",".{0,1000}\/pcmrdp\-client\.dll.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pulseway_x64.deb*",".{0,1000}\/pulseway_x64\.deb.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Pulseway_x64.msi*",".{0,1000}\/Pulseway_x64\.msi.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/pulseway_x86.deb*",".{0,1000}\/pulseway_x86\.deb.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Quasar.git*",".{0,1000}\/Quasar\.git.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*/Quasar.v*.zip*",".{0,1000}\/Quasar\.v.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*/Quasar/releases*",".{0,1000}\/Quasar\/releases.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*/Quick Assist Installer.exe*",".{0,1000}\/Quick\sAssist\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*/Quick%20Assist%20Installer.exe*",".{0,1000}\/Quick\%20Assist\%20Installer\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*/Radmin.exe*",".{0,1000}\/Radmin\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Radmin_Server_*.msi*",".{0,1000}\/Radmin_Server_.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Radmin_Viewer_*.msi*",".{0,1000}\/Radmin_Viewer_.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Radmin_VPN_1.*.exe*",".{0,1000}\/Radmin_VPN_1\..{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemoteControlSetup.exe*",".{0,1000}\/RemoteControlSetup\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemoteDesktop.exe*",".{0,1000}\/RemoteDesktop\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepc.deb*",".{0,1000}\/remotepc\.deb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepc.deb*",".{0,1000}\/remotepc\.deb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePC.exe*",".{0,1000}\/RemotePC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePC.exe*",".{0,1000}\/RemotePC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePC.lnk*",".{0,1000}\/RemotePC\.lnk.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePC.tmp*",".{0,1000}\/RemotePC\.tmp.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepc-attended.deb*",".{0,1000}\/remotepc\-attended\.deb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePCAttended.dmg*",".{0,1000}\/RemotePCAttended\.dmg.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepclauncher.exe*",".{0,1000}\/remotepclauncher\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePCSuite.dmg*",".{0,1000}\/RemotePCSuite\.dmg.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/remotepcuiu.exe*",".{0,1000}\/remotepcuiu\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RemotePCViewer.msi*",".{0,1000}\/RemotePCViewer\.msi.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rfusclient.exe*",".{0,1000}\/rfusclient\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rmm/api/tacticalrmm/*",".{0,1000}\/rmm\/api\/tacticalrmm\/.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/rmm-installer.ps1*",".{0,1000}\/rmm\-installer\.ps1.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/RpcDND_Console.exe*",".{0,1000}\/RpcDND_Console\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rpcdownloader.exe*",".{0,1000}\/rpcdownloader\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RPCFireWallRule.exe*",".{0,1000}\/RPCFireWallRule\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rpcperfviewer.exe*",".{0,1000}\/rpcperfviewer\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RPCProxyLatency.exe*",".{0,1000}\/RPCProxyLatency\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rserver3.exe*",".{0,1000}\/rserver3\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/RustDesk.exe*",".{0,1000}\/RustDesk\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*/rustdesk.git*",".{0,1000}\/rustdesk\.git.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*/rustdesk/rustdesk/releases/*",".{0,1000}\/rustdesk\/rustdesk\/releases\/.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*/rutserv.exe*",".{0,1000}\/rutserv\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/rutview.exe*",".{0,1000}\/rutview\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*$EHORUS_HOME/.vnc/passwd*",".{0,1000}\$EHORUS_HOME\/\.vnc\/passwd.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/simplehelper64.exe*",".{0,1000}\/simplehelper64\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/SolarWinds-Dameware-DRS-St.exe*",".{0,1000}\/SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*/SplashtopStreamer/SPLog.txt*",".{0,1000}\/SplashtopStreamer\/SPLog\.txt.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Supremo.exe*",".{0,1000}\/Supremo\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/system/chrome-remote-desktop@*",".{0,1000}\/system\/chrome\-remote\-desktop\@.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/system/meshagent*",".{0,1000}\/system\/meshagent.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/system/MeshCommander*",".{0,1000}\/system\/MeshCommander.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*/systemd/system/pulseway.service*",".{0,1000}\/systemd\/system\/pulseway\.service.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/tacticalagent.log*",".{0,1000}\/tacticalagent\.log.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tacticalagent-v*-*.exe*",".{0,1000}\/tacticalagent\-v.{0,1000}\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tacticalagent-v*-linux-arm.exe*",".{0,1000}\/tacticalagent\-v.{0,1000}\-linux\-arm\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tacticalagent-v*-windows-amd64.exe*",".{0,1000}\/tacticalagent\-v.{0,1000}\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tacticalrmm.exe*",".{0,1000}\/tacticalrmm\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tacticalrmm.git*",".{0,1000}\/tacticalrmm\.git.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tacticalrmm/master/install.sh*",".{0,1000}\/tacticalrmm\/master\/install\.sh.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tacticalrmm/releases/latest*",".{0,1000}\/tacticalrmm\/releases\/latest.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tacticalrmm-web.git*",".{0,1000}\/tacticalrmm\-web\.git.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*/tightvnc-*.msi*",".{0,1000}\/tightvnc\-.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/tkc_agent_dre.deb*",".{0,1000}\/tkc_agent_dre\.deb.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/tmp/*/enroll.sh*",".{0,1000}\/tmp\/.{0,1000}\/enroll\.sh.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/tmp/*/itsm.service*",".{0,1000}\/tmp\/.{0,1000}\/itsm\.service.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/tmp/*/itsm-linux*",".{0,1000}\/tmp\/.{0,1000}\/itsm\-linux.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/tmp/fleet_remove_log.txt*",".{0,1000}\/tmp\/fleet_remove_log\.txt.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*/usr/bin/anydesk*",".{0,1000}\/usr\/bin\/anydesk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","#linux","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/usr/bin/ehorus_agent*",".{0,1000}\/usr\/bin\/ehorus_agent.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/usr/bin/r-agent*",".{0,1000}\/usr\/bin\/r\-agent.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#linux","linux","10","10","N/A","N/A","N/A","N/A"
"*/usr/bin/r-viewer*",".{0,1000}\/usr\/bin\/r\-viewer.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#linux","linux","10","10","N/A","N/A","N/A","N/A"
"*/usr/lib64/anydesk*",".{0,1000}\/usr\/lib64\/anydesk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/usr/libexec/anydesk*",".{0,1000}\/usr\/libexec\/anydesk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*/usr/local/bin/level*",".{0,1000}\/usr\/local\/bin\/level.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/usr/sbin/pulseway*",".{0,1000}\/usr\/sbin\/pulseway.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/usr/sbin/pulsewayd*",".{0,1000}\/usr\/sbin\/pulsewayd.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/usr/share/applications/r-agent.desktop*",".{0,1000}\/usr\/share\/applications\/r\-agent\.desktop.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","linux","10","10","N/A","N/A","N/A","N/A"
"*/usr/share/applications/r-viewer.desktop*",".{0,1000}\/usr\/share\/applications\/r\-viewer\.desktop.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","linux","10","10","N/A","N/A","N/A","N/A"
"*/var/lib/level/level.db*",".{0,1000}\/var\/lib\/level\/level\.db.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/var/lib/level/level.log*",".{0,1000}\/var\/lib\/level\/level\.log.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/var/log/ehorus_agent.log*",".{0,1000}\/var\/log\/ehorus_agent\.log.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#logfile #linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*/viewerhostkeypopup.exe*",".{0,1000}\/viewerhostkeypopup\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/VPDAgent.exe*",".{0,1000}\/VPDAgent\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/VSAX_x64.msi*",".{0,1000}\/VSAX_x64\.msi.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/vsxrc-clip.exe*",".{0,1000}\/vsxrc\-clip\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/Win7Taskbar.dll*",".{0,1000}\/Win7Taskbar\.dll.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ZA_Connect.exe*",".{0,1000}\/ZA_Connect\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ZAAudioClient.exe*",".{0,1000}\/ZAAudioClient\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ZAFileTransfer.exe*",".{0,1000}\/ZAFileTransfer\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*/ZAService.exe*",".{0,1000}\/ZAService\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*:8040/SetupWizard.aspx*",".{0,1000}\:8040\/SetupWizard\.aspx.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*:9001/proxy/mdmserver1/account*",".{0,1000}\:9001\/proxy\/mdmserver1\/account.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*\*-*-*_rut-*.zip.3bf*","[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}_rut-[0-9]\.[0-9]\.[0-9]\.[0-9]\.zip\.3bf","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\*-internet-id-log.csv*",".{0,1000}\\.{0,1000}\-internet\-id\-log\.csv.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\.dwagent\*",".{0,1000}\\\.dwagent\\.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\.rustdesk*",".{0,1000}\\\.rustdesk.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\\.\pipe\orbit-osquery-extension*",".{0,1000}\\\\\.\\pipe\\orbit\-osquery\-extension.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#namedpipe","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*\\.\pipe\Supremo*",".{0,1000}\\\\\.\\pipe\\Supremo.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","#namedpipe","N/A","10","10","N/A","N/A","N/A","N/A"
"*\\MeshAgent*",".{0,1000}\\\\MeshAgent.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\\RustDeskIddDriver*",".{0,1000}\\\\RustDeskIddDriver.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\127.0.0.1-5900.vnc*",".{0,1000}\\127\.0\.0\.1\-5900\.vnc.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\aa_nts.dll*",".{0,1000}\\aa_nts\.dll.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AA_v3.exe*",".{0,1000}\\AA_v3\.exe.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AA_v3.log*",".{0,1000}\\AA_v3\.log.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Action1\7z.dll*",".{0,1000}\\Action1\\7z\.dll.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Action1\Agent\Certificate*",".{0,1000}\\Action1\\Agent\\Certificate.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Action1\CrashDumps*",".{0,1000}\\Action1\\CrashDumps.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Action1\package_downloads*",".{0,1000}\\Action1\\package_downloads.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Action1\scripts\Run_PowerShell_*",".{0,1000}\\Action1\\scripts\\Run_PowerShell_.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\action1_agent(My_Organization).msi*",".{0,1000}\\action1_agent\(My_Organization\)\.msi.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","product name","10","10","N/A","N/A","N/A","N/A"
"*\ACTION1_AGENT.EXE-*",".{0,1000}\\ACTION1_AGENT\.EXE\-.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\action1_log_*.log*",".{0,1000}\\action1_log_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","example C:\Windows\Action1\logs\action1_log_2023-12-17_13-42-47~10328.log","10","10","N/A","N/A","N/A","N/A"
"*\ad_svc.trace*",".{0,1000}\\ad_svc\.trace.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.inversecos.com/2021/02/forensic-analysis-of-anydesk-logs.html","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\ADM Templates\ADMX\*.admx*",".{0,1000}\\ADM\sTemplates\\ADMX\\.{0,1000}\.admx.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\adprinterpipe*",".{0,1000}\\adprinterpipe.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\Advanced Monitoring Agent\debug.log*",".{0,1000}\\Advanced\sMonitoring\sAgent\\debug\.log.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Advanced Monitoring Agent\staging*",".{0,1000}\\Advanced\sMonitoring\sAgent\\staging.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Advanced Monitoring Agent\task_start.js*",".{0,1000}\\Advanced\sMonitoring\sAgent\\task_start\.js.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Advanced Monitoring Agent\unzip.exe*",".{0,1000}\\Advanced\sMonitoring\sAgent\\unzip\.exe.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Advanced Monitoring Agent\winagent.exe*",".{0,1000}\\Advanced\sMonitoring\sAgent\\winagent\.exe.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AeroAdmin *_Portable.exe*",".{0,1000}\\AeroAdmin\s.{0,1000}_Portable\.exe.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\aeroadmin.exe*",".{0,1000}\\aeroadmin\.exe.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Aeroadmin.lnk*",".{0,1000}\\Aeroadmin\.lnk.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Aeroadmin\black.bmp*",".{0,1000}\\Aeroadmin\\black\.bmp.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Alpemix.ini*",".{0,1000}\\Alpemix\.ini.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Alpemix.zip*",".{0,1000}\\Alpemix\.zip.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AlphaControlAgent\obj\Release\AteraAgent.pdb*",".{0,1000}\\AlphaControlAgent\\obj\\Release\\AteraAgent\.pdb.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AMMYY\access.log*",".{0,1000}\\AMMYY\\access\.log.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AnyDesk (1).exe*",".{0,1000}\\AnyDesk\s\(1\)\.exe.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AnyDesk.exe*",".{0,1000}\\AnyDesk\.exe.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AnyDesk.lnk*",".{0,1000}\\AnyDesk\.lnk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AnyDesk\ad.trace*",".{0,1000}\\AnyDesk\\ad\.trace.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AnyDesk\ad_svc.trace*",".{0,1000}\\AnyDesk\\ad_svc\.trace.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AnyDesk\connection_trace.txt*",".{0,1000}\\AnyDesk\\connection_trace\.txt.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AnyDesk\connection_trace.txt*",".{0,1000}\\AnyDesk\\connection_trace\.txt.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\anydesk\printer_driver*",".{0,1000}\\anydesk\\printer_driver.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AnyDesk\service.conf*",".{0,1000}\\AnyDesk\\service\.conf.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AnyDeskPrintDriver.cat*",".{0,1000}\\AnyDeskPrintDriver\.cat.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\anydeskprintdriver.inf*",".{0,1000}\\anydeskprintdriver\.inf.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\Anyplace Control - Admin.lnk*",".{0,1000}\\Anyplace\sControl\s\-\sAdmin\.lnk.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Anyplace Control\*",".{0,1000}\\Anyplace\sControl\\.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\anyplace-control.ini*",".{0,1000}\\anyplace\-control\.ini.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AnyViewerSetup.exe*",".{0,1000}\\AnyViewerSetup\.exe.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AnyViewerSetup.tmp*",".{0,1000}\\AnyViewerSetup\.tmp.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Apemix.exe*",".{0,1000}\\Apemix\.exe.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\*\rescue.log*",".{0,1000}\\AppData\\Local\\.{0,1000}\\rescue\.log.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\appdata\local\bomgar\bomgar-rep\*",".{0,1000}\\appdata\\local\\bomgar\\bomgar\-rep\\.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\appdata\local\damewa~1\*",".{0,1000}\\appdata\\local\\damewa\~1\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\appdata\local\dameware remote everywhere*",".{0,1000}\\appdata\\local\\dameware\sremote\severywhere.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Downloaded Installations\*\server-3.3.5.0.msi*",".{0,1000}\\AppData\\Local\\Downloaded\sInstallations\\.{0,1000}\\server\-3\.3\.5\.0\.msi.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Downloaded Installations\*\viewer-7.2.2.0.msi*",".{0,1000}\\AppData\\Local\\Downloaded\sInstallations\\.{0,1000}\\viewer\-7\.2\.2\.0\.msi.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\GoToMyPC\*",".{0,1000}\\AppData\\Local\\GoToMyPC\\.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\LMIR*.tmp.bat*",".{0,1000}\\AppData\\Local\\LMIR.{0,1000}\.tmp\.bat.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\LogMeIn Rescue Applet\*",".{0,1000}\\AppData\\Local\\LogMeIn\sRescue\sApplet\\.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\appdata\local\microsoft\windows\inetcache\ie\can_install_pc[1].xml*",".{0,1000}\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\can_install_pc\[1\]\.xml.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\rustdesk\*",".{0,1000}\\AppData\\Local\\rustdesk\\.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\AppData\Local\Temp\*\gosetup.exe*",".{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\gosetup\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\*\GoToOpener.msi*",".{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\GoToOpener\.msi.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\*\NSM.LIC*",".{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\NSM\.LIC.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\*\server-3.3.5.0.exe*",".{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\server\-3\.3\.5\.0\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\*\server-3.3.5.0.msi*",".{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\server\-3\.3\.5\.0\.msi.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\*\zmstage.exe*",".{0,1000}\\AppData\\Local\\Temp\\.{0,1000}\\zmstage\.exe.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\*_Radmin_3.*.zip*",".{0,1000}\\AppData\\Local\\Temp\\.{0,1000}_Radmin_3\..{0,1000}\.zip.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\dwagent*",".{0,1000}\\AppData\\Local\\Temp\\dwagent.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\AppData\Local\Temp\ITarian_Remote_Access_*",".{0,1000}\\AppData\\Local\\Temp\\ITarian_Remote_Access_.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\Remote_Control_by_Itarian*",".{0,1000}\\AppData\\Local\\Temp\\Remote_Control_by_Itarian.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\RemoteHelp\EBWebView*",".{0,1000}\\AppData\\Local\\Temp\\RemoteHelp\\EBWebView.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\Temp\rutserv*",".{0,1000}\\AppData\\Local\\Temp\\rutserv.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Local\ZohoMeeting\*",".{0,1000}\\AppData\\Local\\ZohoMeeting\\.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\LocalLow\LogMeIn Rescue\*",".{0,1000}\\AppData\\LocalLow\\LogMeIn\sRescue\\.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\*\remote.nsm*",".{0,1000}\\AppData\\Roaming\\.{0,1000}\\remote\.nsm.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\*\RemoteDesktop.exe*",".{0,1000}\\AppData\\Roaming\\.{0,1000}\\RemoteDesktop\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\*\uac.tmp",".{0,1000}\\AppData\\Roaming\\.{0,1000}\\uac\.tmp","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\*-5900.vnc*",".{0,1000}\\AppData\\Roaming\\.{0,1000}\-5900\.vnc.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\appdata\roaming\*'DestPort'>4782</Data>*",".{0,1000}\\appdata\\roaming\\.{0,1000}\'DestPort\'\>4782\<\/Data\>.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\AppData\Roaming\AnyDesk\system.conf*",".{0,1000}\\AppData\\Roaming\\AnyDesk\\system\.conf.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\AnyDesk\user.conf*",".{0,1000}\\AppData\\Roaming\\AnyDesk\\user\.conf.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\Anyplace Control*",".{0,1000}\\AppData\\Roaming\\Anyplace\sControl.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\DameWare Development\*",".{0,1000}\\AppData\\Roaming\\DameWare\sDevelopment\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\freerdp*",".{0,1000}\\AppData\\Roaming\\freerdp.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\NetSupport\*",".{0,1000}\\AppData\\Roaming\\NetSupport\\.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\Radmin*",".{0,1000}\\AppData\\Roaming\\Radmin.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\Remote Utilities Files*",".{0,1000}\\AppData\\Roaming\\Remote\sUtilities\sFiles.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\TeamViewer*",".{0,1000}\\AppData\\Roaming\\TeamViewer.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\UltraVNC\*",".{0,1000}\\AppData\\Roaming\\UltraVNC\\.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AppData\Roaming\VSA X*",".{0,1000}\\AppData\\Roaming\\VSA\sX.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Assistance rapide Installer.exe*",".{0,1000}\\Assistance\srapide\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\Assistenza rapida Installer.exe*",".{0,1000}\\Assistenza\srapida\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\atera_agent.exe*",".{0,1000}\\atera_agent\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AttendedServiceRemove.exe*",".{0,1000}\\AttendedServiceRemove\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AttendedUDP.zip*",".{0,1000}\\AttendedUDP\.zip.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Aweray Remote.lnk*",".{0,1000}\\Aweray\sRemote\.lnk.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Aweray_Remote_*.exe*",".{0,1000}\\Aweray_Remote_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Aweray_Remote_*.zip*",".{0,1000}\\Aweray_Remote_.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\AweSun.exe*",".{0,1000}\\AweSun\.exe.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\baconsoleapp.exe*",".{0,1000}\\baconsoleapp\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\baconsoleappen.dll*",".{0,1000}\\baconsoleappen\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\baseclient.exe* -consoleinstallcomplete*",".{0,1000}\\baseclient\.exe.{0,1000}\s\-consoleinstallcomplete.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupclphlp.exe*",".{0,1000}\\basupclphlp\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupclpprg.exe*",".{0,1000}\\basupclpprg\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupconhelper.exe*",".{0,1000}\\basupconhelper\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basuplib.dll*",".{0,1000}\\basuplib\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupportexpresssrvcupdater_dameware*",".{0,1000}\\basupportexpresssrvcupdater_dameware.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupportexpressstandaloneservice_dameware*",".{0,1000}\\basupportexpressstandaloneservice_dameware.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupregedithlpr.exe*",".{0,1000}\\basupregedithlpr\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupregedithlpr_*.log*",".{0,1000}\\basupregedithlpr_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvc.cfg*",".{0,1000}\\basupsrvc\.cfg.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvc.exe*",".{0,1000}\\basupsrvc\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvc.ico*",".{0,1000}\\basupsrvc\.ico.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvc.ini*",".{0,1000}\\basupsrvc\.ini.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvc.xml*",".{0,1000}\\basupsrvc\.xml.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvc_*.log*",".{0,1000}\\basupsrvc_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfg.exe*",".{0,1000}\\basupsrvccnfg\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfg_*.log*",".{0,1000}\\basupsrvccnfg_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfg_dameware*",".{0,1000}\\basupsrvccnfg_dameware.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfgde.dll*",".{0,1000}\\basupsrvccnfgde\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfgen.dll*",".{0,1000}\\basupsrvccnfgen\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfges.dll*",".{0,1000}\\basupsrvccnfges\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfgfr.dll*",".{0,1000}\\basupsrvccnfgfr\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfgit.dll*",".{0,1000}\\basupsrvccnfgit\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvccnfgpt.dll*",".{0,1000}\\basupsrvccnfgpt\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvcde.dll*",".{0,1000}\\basupsrvcde\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvcen.dll*",".{0,1000}\\basupsrvcen\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvces.dll*",".{0,1000}\\basupsrvces\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvcevnt3.dll*",".{0,1000}\\basupsrvcevnt3\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvcfr.dll*",".{0,1000}\\basupsrvcfr\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvcit.dll*",".{0,1000}\\basupsrvcit\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvcpt.dll*",".{0,1000}\\basupsrvcpt\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvcupdater.exe*",".{0,1000}\\basupsrvcupdater\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsrvcupdater_*.log*",".{0,1000}\\basupsrvcupdater_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsysinf*.log*",".{0,1000}\\basupsysinf.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsysinf.exe*",".{0,1000}\\basupsysinf\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsysinf.ini*",".{0,1000}\\basupsysinf\.ini.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsysshell.exe*",".{0,1000}\\basupsysshell\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupsysshell64.exe*",".{0,1000}\\basupsysshell64\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basuptshelper.exe*",".{0,1000}\\basuptshelper\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basuptshelper_*.log*",".{0,1000}\\basuptshelper_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basuptshelperlib.dll*",".{0,1000}\\basuptshelperlib\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupunelev.exe*",".{0,1000}\\basupunelev\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\basupvista.dll*",".{0,1000}\\basupvista\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\bavideochat.exe*",".{0,1000}\\bavideochat\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\bawhook.dll*",".{0,1000}\\bawhook\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\beanywhere support express service - [dameware]*",".{0,1000}\\beanywhere\ssupport\sexpress\sservice\s\-\s\[dameware\].{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Bomgar-enum_cp-*",".{0,1000}\\Bomgar\-enum_cp\-.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\bomgar-rep.cache\*",".{0,1000}\\bomgar\-rep\.cache\\.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\bomgar-rep.exe*",".{0,1000}\\bomgar\-rep\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\bomgar-rep-installer.exe*",".{0,1000}\\bomgar\-rep\-installer\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\bomgar-scc-*.exe*",".{0,1000}\\bomgar\-scc\-.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\bomgar-scc.exe*",".{0,1000}\\bomgar\-scc\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\BOMGAR-SCC.EXE-*",".{0,1000}\\BOMGAR\-SCC\.EXE\-.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\BRMM_2024.1-Release*",".{0,1000}\\BRMM_2024\.1\-Release.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\BSUtility.exe*",".{0,1000}\\BSUtility\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\cbhook-x86.dll*",".{0,1000}\\cbhook\-x86\.dll.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Chrome Remote Desktop\host.json*",".{0,1000}\\Chrome\sRemote\sDesktop\\host\.json.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Citrix\GoToMyPc\FileTransfer\history*",".{0,1000}\\Citrix\\GoToMyPc\\FileTransfer\\history.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Citrix\GoToMyPc\GuestInvite*",".{0,1000}\\Citrix\\GoToMyPc\\GuestInvite.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ComodoRemoteControl.exe*",".{0,1000}\\ComodoRemoteControl\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\config\RustDesk.toml*",".{0,1000}\\config\\RustDesk\.toml.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\config\RustDesk_local.*",".{0,1000}\\config\\RustDesk_local\..{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\Control\Print\Monitors\REMOTEPCPRINTER*",".{0,1000}\\Control\\Print\\Monitors\\REMOTEPCPRINTER.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Control\SafeBoot\Network\SupremoService*",".{0,1000}\\Control\\SafeBoot\\Network\\SupremoService.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\ControlSet001\Control\SafeBoot\Network\AmmyyAdmin_*",".{0,1000}\\ControlSet001\\Control\\SafeBoot\\Network\\AmmyyAdmin_.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ControlSet001\Services\AnyDesk*",".{0,1000}\\ControlSet001\\Services\\AnyDesk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\createpassword.exe*",".{0,1000}\\createpassword\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Control\SafeBoot\Network\AeroadminService*",".{0,1000}\\CurrentControlSet\\Control\\SafeBoot\\Network\\AeroadminService.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (*",".{0,1000}\\CurrentControlSet\\Control\\SafeBoot\\Network\\ScreenConnect\sClient\s\(.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\AeroadminService*",".{0,1000}\\CurrentControlSet\\Services\\AeroadminService.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\AlpemixSrvcx*",".{0,1000}\\CurrentControlSet\\Services\\AlpemixSrvcx.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\bam\State\UserSettings\*\MicrosoftCorporationII.QuickAssist_*",".{0,1000}\\CurrentControlSet\\Services\\bam\\State\\UserSettings\\.{0,1000}\\MicrosoftCorporationII\.QuickAssist_.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","#registry","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\ItsmRsp*",".{0,1000}\\CurrentControlSet\\Services\\ItsmRsp.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","#servicename #registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\ITSMService*",".{0,1000}\\CurrentControlSet\\Services\\ITSMService.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","#servicename #registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\Mesh*",".{0,1000}\\CurrentControlSet\\Services\\Mesh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","#registry","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\CurrentControlSet\Services\MiniInternetIdService*",".{0,1000}\\CurrentControlSet\\Services\\MiniInternetIdService.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\RmmService*",".{0,1000}\\CurrentControlSet\\Services\\RmmService.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","#servicename #registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\ScreenConnect *",".{0,1000}\\CurrentControlSet\\Services\\ScreenConnect\s.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\SupremoService*",".{0,1000}\\CurrentControlSet\\Services\\SupremoService.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","#servicename #registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\TeamViewer*",".{0,1000}\\CurrentControlSet\\Services\\TeamViewer.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","#servicename #registry","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\VSAX*",".{0,1000}\\CurrentControlSet\\Services\\VSAX.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#servicename #registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\CurrentControlSet\Services\Zoho Assist-Remote Support*",".{0,1000}\\CurrentControlSet\\Services\\Zoho\sAssist\-Remote\sSupport.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","#servicename #registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentVersion\App Paths\RemotePCPerformance*",".{0,1000}\\CurrentVersion\\App\sPaths\\RemotePCPerformance.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\CurrentVersion\Devices\Remote Utilities Printer*",".{0,1000}\\CurrentVersion\\Devices\\Remote\sUtilities\sPrinter.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\CurrentVersion\Devices\RemotePC Printer*",".{0,1000}\\CurrentVersion\\Devices\\RemotePC\sPrinter.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\CurrentVersion\Run\Bomgar Support Reconnect*",".{0,1000}\\CurrentVersion\\Run\\Bomgar\sSupport\sReconnect.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentVersion\Run\DWAgentMon*",".{0,1000}\\CurrentVersion\\Run\\DWAgentMon.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\CurrentVersion\Run\Quasar Client Startup*",".{0,1000}\\CurrentVersion\\Run\\Quasar\sClient\sStartup.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\currentversion\uninstall\dameware remote everywhere*",".{0,1000}\\currentversion\\uninstall\\dameware\sremote\severywhere.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentVersion\Uninstall\Representative Console [eval-*",".{0,1000}\\CurrentVersion\\Uninstall\\Representative\sConsole\s\[eval\-.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\CurrentVersion\Uninstall\RustDesk*",".{0,1000}\\CurrentVersion\\Uninstall\\RustDesk.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\CurrentVersion\Uninstall\Ultravnc2_is1\*",".{0,1000}\\CurrentVersion\\Uninstall\\Ultravnc2_is1\\.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*\DameWare Development\MrcVerbLog*",".{0,1000}\\DameWare\sDevelopment\\MrcVerbLog.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\Dameware Mini Remote Control x64\*",".{0,1000}\\Dameware\sMini\sRemote\sControl\sx64\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\dameware mini remote control x64\*",".{0,1000}\\dameware\smini\sremote\scontrol\sx64\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DameWare Mini Remote Control*.exe*",".{0,1000}\\DameWare\sMini\sRemote\sControl.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\Dameware Mini Remote Control.lnk*",".{0,1000}\\Dameware\sMini\sRemote\sControl\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\dameware remote everywhere agent*",".{0,1000}\\dameware\sremote\severywhere\sagent.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\dameware remote everywhere.lnk*",".{0,1000}\\dameware\sremote\severywhere\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Dameware Remote Support .lnk*",".{0,1000}\\Dameware\sRemote\sSupport\s\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\Dameware Remote Support\*",".{0,1000}\\Dameware\sRemote\sSupport\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\DameWare.Diagnostics*",".{0,1000}\\DameWare\.Diagnostics.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DameWare.LogAdjuster.exe*",".{0,1000}\\DameWare\.LogAdjuster\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DameWare.LogAdjuster.exe.config*",".{0,1000}\\DameWare\.LogAdjuster\.exe\.config.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\damewareagent.exe",".{0,1000}\\damewareagent\.exe","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\damewareagent.exe*",".{0,1000}\\damewareagent\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\damewareremoteeverywhere\*",".{0,1000}\\damewareremoteeverywhere\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\damewareremoteeverywhereagentinstaller.install.log*",".{0,1000}\\damewareremoteeverywhereagentinstaller\.install\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\dctoolshardware.exe*",".{0,1000}\\dctoolshardware\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\disable dameware remote everywhere agent.lnk*",".{0,1000}\\disable\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\DMRC-10-Evaluation.lic*",".{0,1000}\\DMRC\-10\-Evaluation\.lic.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DNTU.exe*",".{0,1000}\\DNTU\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\Documents\ConnectWiseControl\Files*",".{0,1000}\\Documents\\ConnectWiseControl\\Files.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\dre_mac_console.zip*",".{0,1000}\\dre_mac_console\.zip.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\drivers\x64\rupdui.dll*",".{0,1000}\\drivers\\x64\\rupdui\.dll.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\dwagent.exe*",".{0,1000}\\dwagent\.exe.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\DWAgent.lnk*",".{0,1000}\\DWAgent\.lnk.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwagent.log*",".{0,1000}\\dwagent\.log.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwagent.pid*",".{0,1000}\\dwagent\.pid.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwagent.start*",".{0,1000}\\dwagent\.start.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwagent.stop*",".{0,1000}\\dwagent\.stop.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwaggdi.dll*",".{0,1000}\\dwaggdi\.dll.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwaginstall.log*",".{0,1000}\\dwaginstall\.log.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwaglnc.exe*",".{0,1000}\\dwaglnc\.exe.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwagsvc.exe*",".{0,1000}\\dwagsvc\.exe.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\dwagupd.dll*",".{0,1000}\\dwagupd\.dll.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\DWAMTD.dll*",".{0,1000}\\DWAMTD\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWAMTDRES.dll*",".{0,1000}\\DWAMTDRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWMRC_St_64.msi*",".{0,1000}\\DWMRC_St_64\.msi.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWMSISET.W32*",".{0,1000}\\DWMSISET\.W32.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWMSISET.X64*",".{0,1000}\\DWMSISET\.X64.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWNativeWCFClient.dll*",".{0,1000}\\DWNativeWCFClient\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWNativeWCFClientRES.dll*",".{0,1000}\\DWNativeWCFClientRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWPing.dll*",".{0,1000}\\DWPing\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWPINGRES.dll*",".{0,1000}\\DWPINGRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCBA.dll*",".{0,1000}\\DWRCBA\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCBN.dll*",".{0,1000}\\DWRCBN\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCC.chm*",".{0,1000}\\DWRCC\.chm.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCC.exe*",".{0,1000}\\DWRCC\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCC.log*",".{0,1000}\\DWRCC\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCC.log*",".{0,1000}\\DWRCC\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\DWRCC.Logging.xml*",".{0,1000}\\DWRCC\.Logging\.xml.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCCH.dll*",".{0,1000}\\DWRCCH\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCChat.dll*",".{0,1000}\\DWRCChat\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCChatRES.dll*",".{0,1000}\\DWRCChatRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCCMD.exe*",".{0,1000}\\DWRCCMD\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCCRES.dll*",".{0,1000}\\DWRCCRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCCSFTv2.data*",".{0,1000}\\DWRCCSFTv2\.data.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCD.dll*",".{0,1000}\\DWRCD\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCD.dll*",".{0,1000}\\DWRCD\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCK.dll*",".{0,1000}\\DWRCK\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCOP.dll*",".{0,1000}\\DWRCOP\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCOPRES.dll*",".{0,1000}\\DWRCOPRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCPN.dll*",".{0,1000}\\DWRCPN\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCRSA.dll*",".{0,1000}\\DWRCRSA\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCRSS.dll*",".{0,1000}\\DWRCRSS\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCRSS.dll*",".{0,1000}\\DWRCRSS\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCS.exe*",".{0,1000}\\DWRCS\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCS.Logging.xml*",".{0,1000}\\DWRCS\.Logging\.xml.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCS.reg*",".{0,1000}\\DWRCS\.reg.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSET.dll*",".{0,1000}\\DWRCSET\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSETRES.dll*",".{0,1000}\\DWRCSETRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSh.dll*",".{0,1000}\\DWRCSh\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSHRegister.cmd*",".{0,1000}\\DWRCSHRegister\.cmd.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSI.dll*",".{0,1000}\\DWRCSI\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSI.dll*",".{0,1000}\\DWRCSI\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSIRES.dll*",".{0,1000}\\DWRCSIRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSMSI.exe*",".{0,1000}\\DWRCSMSI\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSMSIRES.dll*",".{0,1000}\\DWRCSMSIRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSPC.exe*",".{0,1000}\\DWRCSPC\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSPCRES.dll*",".{0,1000}\\DWRCSPCRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSPX.exe*",".{0,1000}\\DWRCSPX\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSPXRES.dll*",".{0,1000}\\DWRCSPXRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSRES.dll*",".{0,1000}\\DWRCSRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCST.exe*",".{0,1000}\\DWRCST\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCST.Logging.xml*",".{0,1000}\\DWRCST\.Logging\.xml.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCSTRES.dll*",".{0,1000}\\DWRCSTRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCU3.dll*",".{0,1000}\\DWRCU3\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCWHD.Logging.xml*",".{0,1000}\\DWRCWHD\.Logging\.xml.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCWHDAPI.dll*",".{0,1000}\\DWRCWHDAPI\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCWHDUI.dll*",".{0,1000}\\DWRCWHDUI\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCWHDUIRES.dll*",".{0,1000}\\DWRCWHDUIRES\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCWol.dll*",".{0,1000}\\DWRCWol\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRCWXL.dll*",".{0,1000}\\DWRCWXL\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRTD.dll*",".{0,1000}\\DWRTD\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRTDE.exe*",".{0,1000}\\DWRTDE\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRTDR.dll*",".{0,1000}\\DWRTDR\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWRTDR.dll*",".{0,1000}\\DWRTDR\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWSGRWRP.dll*",".{0,1000}\\DWSGRWRP\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWUtil.dll*",".{0,1000}\\DWUtil\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\DWWFDS.dll*",".{0,1000}\\DWWFDS\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\embedhook-x64.exe*",".{0,1000}\\embedhook\-x64\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\embedhook-x86.exe*",".{0,1000}\\embedhook\-x86\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\enable dameware remote everywhere agent.lnk*",".{0,1000}\\enable\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\eventlog\application\dameware *",".{0,1000}\\eventlog\\application\\dameware\s.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\file_transfer_trace.txt*",".{0,1000}\\file_transfer_trace\.txt.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://upadhyayraj.medium.com/beyond-connection-logs-understanding-file-transfer-artifacts-in-anydesk-forensics-b5812c817aad","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\g2comm.exe*",".{0,1000}\\g2comm\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\g2fileh.exe*",".{0,1000}\\g2fileh\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\g2host.exe*",".{0,1000}\\g2host\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\g2mainh.exe*",".{0,1000}\\g2mainh\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\g2printh.exe*",".{0,1000}\\g2printh\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\g2svc.exe*",".{0,1000}\\g2svc\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\getsupportservice_common_dameware*",".{0,1000}\\getsupportservice_common_dameware.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\getsupportservice_dameware*",".{0,1000}\\getsupportservice_dameware.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\getsupportservice_dameware\*",".{0,1000}\\getsupportservice_dameware\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\goLoader.exe*",".{0,1000}\\goLoader\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Google\Chrome Remote Desktop\*",".{0,1000}\\Google\\Chrome\sRemote\sDesktop\\.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\gosetup[1].exe*",".{0,1000}\\gosetup\[1\]\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\GoTo Opener.exe*",".{0,1000}\\GoTo\sOpener\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\GoTo\Logs\goto.log*",".{0,1000}\\GoTo\\Logs\\goto\.log.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\gotomon.dll*",".{0,1000}\\gotomon\.dll.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\gotomon_x64.dll*",".{0,1000}\\gotomon_x64\.dll.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\GoToMyPC.cab*",".{0,1000}\\GoToMyPC\.cab.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\GoToMyPC\*\*\g2ldr.log*",".{0,1000}\\GoToMyPC\\.{0,1000}\\.{0,1000}\\g2ldr\.log.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\gotomypc\g2pre.exe*",".{0,1000}\\gotomypc\\g2pre\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\GoToMyPC\g2svc.exe*",".{0,1000}\\GoToMyPC\\g2svc\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\gotomypc_3944.exe*",".{0,1000}\\gotomypc_3944\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\GoToMyPCCrashHandler.exe*",".{0,1000}\\GoToMyPCCrashHandler\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\GoToOpener.log*",".{0,1000}\\GoToOpener\.log.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\GoToOpener[1].msi*",".{0,1000}\\GoToOpener\[1\]\.msi.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\HiddenDesktop.h*",".{0,1000}\\HiddenDesktop\.h.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*\host-7.2.2.0.msi*",".{0,1000}\\host\-7\.2\.2\.0\.msi.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\hvnc.exe*",".{0,1000}\\hvnc\.exe.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*\HVNC.sln*",".{0,1000}\\HVNC\.sln.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*\HVNC.vcxproj*",".{0,1000}\\HVNC\.vcxproj.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*\HVNC-main.zip*",".{0,1000}\\HVNC\-main\.zip.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*\ICON_ID_GOTOMYPC*",".{0,1000}\\ICON_ID_GOTOMYPC.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\InternetIdService.exe*",".{0,1000}\\InternetIdService\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\InternetIdService_*-*-*.txt",".{0,1000}\\InternetIdService_.{0,1000}\-.{0,1000}\-.{0,1000}\.txt","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\InventoryApplicationFile\aeroadmin*",".{0,1000}\\InventoryApplicationFile\\aeroadmin.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\InventoryApplicationFile\rpcattendedadmin*",".{0,1000}\\InventoryApplicationFile\\rpcattendedadmin.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\InventoryApplicationFile\screenconnect.cl*",".{0,1000}\\InventoryApplicationFile\\screenconnect\.cl.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\InventoryApplicationFile\screenconnect.wi*",".{0,1000}\\InventoryApplicationFile\\screenconnect\.wi.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\InventoryApplicationFile\tacticalagent-v2*",".{0,1000}\\InventoryApplicationFile\\tacticalagent\-v2.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","#registry","registry","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\InventoryApplicationFile\ultravnc_*",".{0,1000}\\InventoryApplicationFile\\ultravnc_.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*\InventoryApplicationFile\zaservice.exe*",".{0,1000}\\InventoryApplicationFile\\zaservice\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ITarian Remote Access.lnk*",".{0,1000}\\ITarian\sRemote\sAccess\.lnk.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\itarian\endpoint manager\itsmagent.exe*",".{0,1000}\\itarian\\endpoint\smanager\\itsmagent\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\itarian\endpoint manager\itsmservice.exe*",".{0,1000}\\itarian\\endpoint\smanager\\itsmservice\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\itarian\endpoint manager\rhost.exe*",".{0,1000}\\itarian\\endpoint\smanager\\rhost\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ITarian\RemoteControl*",".{0,1000}\\ITarian\\RemoteControl.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ITarian_Remote_Access_*.log*",".{0,1000}\\ITarian_Remote_Access_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ITarianRemoteAccess.exe*",".{0,1000}\\ITarianRemoteAccess\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\JWrapper-SimpleHelp Remote Work*",".{0,1000}\\JWrapper\-SimpleHelp\sRemote\sWork.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\JWrapper-SimpleHelp Technician*",".{0,1000}\\JWrapper\-SimpleHelp\sTechnician.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\JWrapper-SimpleHelp Technician\*",".{0,1000}\\JWrapper\-SimpleHelp\sTechnician\\.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Kaseya\PC Monitor\*",".{0,1000}\\Kaseya\\PC\sMonitor\\.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\level.exe*--check-service*",".{0,1000}\\level\.exe.{0,1000}\-\-check\-service.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\level-remote-control-ffmpeg.exe.download*",".{0,1000}\\level\-remote\-control\-ffmpeg\.exe\.download.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\level-windows-amd64.exe*",".{0,1000}\\level\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\level-windows-arm64.exe*",".{0,1000}\\level\-windows\-arm64\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\librustdesk.dll*",".{0,1000}\\librustdesk\.dll.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\linuxconsole_dw (1).zip*",".{0,1000}\\linuxconsole_dw\s\(1\)\.zip.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMI_Rescue.exe*",".{0,1000}\\LMI_Rescue\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\lmi_rescue_srv.exe*",".{0,1000}\\lmi_rescue_srv\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIGuardianEvt.dll*",".{0,1000}\\LMIGuardianEvt\.dll.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIR*.tmp\rarcc.dll*",".{0,1000}\\LMIR.{0,1000}\.tmp\\rarcc\.dll.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIRescue-*.clog*",".{0,1000}\\LMIRescue\-.{0,1000}\.clog.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIRescue-*.connlog*",".{0,1000}\\LMIRescue\-.{0,1000}\.connlog.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIRescueCOL.log*",".{0,1000}\\LMIRescueCOL\.log.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIRescueMqttMessages_*.dat*",".{0,1000}\\LMIRescueMqttMessages_.{0,1000}\.dat.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIRescueUpdater.log*",".{0,1000}\\LMIRescueUpdater\.log.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIRhook.000.dll*",".{0,1000}\\LMIRhook\.000\.dll.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\lmirtechconsole.exe*",".{0,1000}\\lmirtechconsole\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMIRTechConsole.exe*",".{0,1000}\\LMIRTechConsole\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LMITrs-*.trs*",".{0,1000}\\LMITrs\-.{0,1000}\.trs.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Local\Temp\LogMeInLogs\GoToOpenerMsi\*",".{0,1000}\\Local\\Temp\\LogMeInLogs\\GoToOpenerMsi\\.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\log\FileTransferWindowAppLog.log*",".{0,1000}\\log\\FileTransferWindowAppLog\.log.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LogMeIn Rescue Applet\LMIR*",".{0,1000}\\LogMeIn\sRescue\sApplet\\LMIR.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LogMeIn Rescue Applet\LMIR*",".{0,1000}\\LogMeIn\sRescue\sApplet\\LMIR.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LogMeIn Rescue AVI Codec\*",".{0,1000}\\LogMeIn\sRescue\sAVI\sCodec\\.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\logmein rescue technician console\*",".{0,1000}\\logmein\srescue\stechnician\sconsole\\.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LogMeIn\Dumps\*",".{0,1000}\\LogMeIn\\Dumps\\.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LogMeInLogs\GoToOpenerMsi*",".{0,1000}\\LogMeInLogs\\GoToOpenerMsi.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\LogMeInRescue_ipc*",".{0,1000}\\LogMeInRescue_ipc.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","pipename","10","10","N/A","N/A","N/A","N/A"
"*\LogMeInRescue_rarc_r_*",".{0,1000}\\LogMeInRescue_rarc_r_.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","pipename","10","10","N/A","N/A","N/A","N/A"
"*\LogMeInRescue_rarc_w_*",".{0,1000}\\LogMeInRescue_rarc_w_.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","pipename","10","10","N/A","N/A","N/A","N/A"
"*\LogMeInRescueTechnicianConsole_x64*",".{0,1000}\\LogMeInRescueTechnicianConsole_x64.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\logs\baseclient_*.log*",".{0,1000}\\logs\\baseclient_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\logs\baseconsoleapp_*.log*",".{0,1000}\\logs\\baseconsoleapp_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\logs\basupclphlp_*.log*",".{0,1000}\\logs\\basupclphlp_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Logs\DNTU.log*",".{0,1000}\\Logs\\DNTU\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\logs\RCService.txt*",".{0,1000}\\logs\\RCService\.txt.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Logs\rut_log_*.html*",".{0,1000}\\Logs\\rut_log_.{0,1000}\.html.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\meshagent.db*",".{0,1000}\\meshagent\.db.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\MeshAgent.sln*",".{0,1000}\\MeshAgent\.sln.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\MeshAgentKvm.log*",".{0,1000}\\MeshAgentKvm\.log.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\MeshAgent-master*",".{0,1000}\\MeshAgent\-master.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\meshcentral.db*",".{0,1000}\\meshcentral\.db.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\meshcentral.js*",".{0,1000}\\meshcentral\.js.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\MeshCentral.sln*",".{0,1000}\\MeshCentral\.sln.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\MeshCentral\*",".{0,1000}\\MeshCentral\\.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\MeshCmd.exe*",".{0,1000}\\MeshCmd\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\meshcmd.js*",".{0,1000}\\meshcmd\.js.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\meshcommander.dmp*",".{0,1000}\\meshcommander\.dmp.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\MeshMessenger.exe*",".{0,1000}\\MeshMessenger\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\MeshService.rc*",".{0,1000}\\MeshService\.rc.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\Microsoft.RemoteAssistance.QuickAssist\*",".{0,1000}\\Microsoft\.RemoteAssistance\.QuickAssist\\.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\microsoft.remoteassistance.quickassist\*",".{0,1000}\\microsoft\.remoteassistance\.quickassist\\.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\Mini Remote Control Client Agent MSI Builder.lnk*",".{0,1000}\\Mini\sRemote\sControl\sClient\sAgent\sMSI\sBuilder\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\Mini Remote Control Diagnostics.lnk*",".{0,1000}\\Mini\sRemote\sControl\sDiagnostics\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\Mini Remote Control Help.lnk*",".{0,1000}\\Mini\sRemote\sControl\sHelp\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\Mini Remote Control Log Adjuster.lnk*",".{0,1000}\\Mini\sRemote\sControl\sLog\sAdjuster\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\Mini Remote Control Service*",".{0,1000}\\Mini\sRemote\sControl\sService.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\Mini Remote Control Service\Settings\SFT: Upload Folder*",".{0,1000}\\Mini\sRemote\sControl\sService\\Settings\\SFT\:\sUpload\sFolder.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\Mini Remote Control.lnk*",".{0,1000}\\Mini\sRemote\sControl\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\mlnhcpkomdeavomsjalt*",".{0,1000}\\mlnhcpkomdeavomsjalt.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","named pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L2","10","10","N/A","N/A","N/A","N/A"
"*\MMSOFT Design\PC Monitor*",".{0,1000}\\MMSOFT\sDesign\\PC\sMonitor.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\MMSOFT Design\Pulseway\*",".{0,1000}\\MMSOFT\sDesign\\Pulseway\\.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\MRC_12.0_Bootstrap_Install_Log.txt*",".{0,1000}\\MRC_12\.0_Bootstrap_Install_Log\.txt.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\MRCCv2.db*",".{0,1000}\\MRCCv2\.db.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\mspacredentialprovider_*_dameware.dll*",".{0,1000}\\mspacredentialprovider_.{0,1000}_dameware\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\msparegedithelper_*",".{0,1000}\\msparegedithelper_.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\mspxtshlpsrv_*",".{0,1000}\\mspxtshlpsrv_.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\mspxwebcom.dll*",".{0,1000}\\mspxwebcom\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\multiplicar negocios\beanywhere support express*",".{0,1000}\\multiplicar\snegocios\\beanywhere\ssupport\sexpress.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\MWDiagnosticCollector.exe*",".{0,1000}\\MWDiagnosticCollector\.exe.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\MWDiagnosticCollectorResult_*.zip*",".{0,1000}\\MWDiagnosticCollectorResult_.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\NETSUP~1\PCIShellExt64.dll*",".{0,1000}\\NETSUP\~1\\PCIShellExt64\.dll.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\NetSupport Ltd\Client32*",".{0,1000}\\NetSupport\sLtd\\Client32.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\NetSupport Ltd\PCICTL*",".{0,1000}\\NetSupport\sLtd\\PCICTL.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\netsupport manager\*",".{0,1000}\\netsupport\smanager\\.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\NetSupport School Console*",".{0,1000}\\NetSupport\sSchool\sConsole.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\NetSupport School\*",".{0,1000}\\NetSupport\sSchool\\.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\NetSupport School\NetSupport*",".{0,1000}\\NetSupport\sSchool\\NetSupport.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\node_modules\meshcentral*",".{0,1000}\\node_modules\\meshcentral.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\novaPDF11OEM(x64).msi*",".{0,1000}\\novaPDF11OEM\(x64\)\.msi.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\nspowershell.exe*",".{0,1000}\\nspowershell\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\nssadmui.exe*",".{0,1000}\\nssadmui\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Open Source\MeshCentral\*",".{0,1000}\\Open\sSource\\MeshCentral\\.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*\options.vnc*",".{0,1000}\\options\.vnc.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*\PC Monitor\Addons*",".{0,1000}\\PC\sMonitor\\Addons.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\pcicfgui_client.exe*",".{0,1000}\\pcicfgui_client\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pciconn.exe*",".{0,1000}\\pciconn\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCICTL\ConfigList\Standard\UI\*",".{0,1000}\\PCICTL\\ConfigList\\Standard\\UI\\.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pcictlui.exe*",".{0,1000}\\pcictlui\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCIDEPLY.exe*",".{0,1000}\\PCIDEPLY\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCINSSCD.exe*",".{0,1000}\\PCINSSCD\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCINSSUI.exe*",".{0,1000}\\PCINSSUI\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCISCRUI.exe*",".{0,1000}\\PCISCRUI\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCIShellExt64.dll*",".{0,1000}\\PCIShellExt64\.dll.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCMonitorManager.exe*",".{0,1000}\\PCMonitorManager\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCMonitorSrv.exe*",".{0,1000}\\PCMonitorSrv\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PCMonitorTypes.dll*",".{0,1000}\\PCMonitorTypes\.dll.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pcmontask.exe*",".{0,1000}\\pcmontask\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pcmrdp-client.dll*",".{0,1000}\\pcmrdp\-client\.dll.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pcmupdate.exe*",".{0,1000}\\pcmupdate\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pcmupdate.exe*",".{0,1000}\\pcmupdate\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pcmupdate.exe.config*",".{0,1000}\\pcmupdate\.exe\.config.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Pictures\AnyDesk*",".{0,1000}\\Pictures\\AnyDesk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\pipe\chrome_remote_desktop*",".{0,1000}\\pipe\\chrome_remote_desktop.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","#namedpipe","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Prefetch\ANYDESK.EXE*",".{0,1000}\\Prefetch\\ANYDESK\.EXE.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\baconsoleapp.exe*",".{0,1000}\\prefetch\\baconsoleapp\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\baseclient.exe*",".{0,1000}\\prefetch\\baseclient\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\basupclphlp.exe*",".{0,1000}\\prefetch\\basupclphlp\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\basupregedithlpr.exe*",".{0,1000}\\prefetch\\basupregedithlpr\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\basupsrvc.exe*",".{0,1000}\\prefetch\\basupsrvc\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\basupsrvccnfg.exe*",".{0,1000}\\prefetch\\basupsrvccnfg\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\basupsrvcupdater.exe*",".{0,1000}\\prefetch\\basupsrvcupdater\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\basupsysinf.exe*",".{0,1000}\\prefetch\\basupsysinf\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\basuptshelper.exe*",".{0,1000}\\prefetch\\basuptshelper\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\damewareagent.exe*",".{0,1000}\\prefetch\\damewareagent\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\damewareremoteeverywhereconso*",".{0,1000}\\prefetch\\damewareremoteeverywhereconso.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Prefetch\QUASAR.EXE*",".{0,1000}\\Prefetch\\QUASAR\.EXE.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\prefetch\tcrmtshellagent.exe*",".{0,1000}\\prefetch\\tcrmtshellagent\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\tcrmtshellviewer.exe*",".{0,1000}\\prefetch\\tcrmtshellviewer\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\prefetch\tkcuploader.exe*",".{0,1000}\\prefetch\\tkcuploader\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Print\Printers\RemotePC Printer\*",".{0,1000}\\Print\\Printers\\RemotePC\sPrinter\\.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Printers\Remote Utilities Printer\*",".{0,1000}\\Printers\\Remote\sUtilities\sPrinter\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\progra~2\damewa~1\remoteshell\*",".{0,1000}\\progra\~2\\damewa\~1\\remoteshell\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\Advanced Monitoring Agent\*",".{0,1000}\\Program\sFiles\s\(x86\)\\Advanced\sMonitoring\sAgent\\.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\Anyplace Control*",".{0,1000}\\Program\sFiles\s\(x86\)\\Anyplace\sControl.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\Atera Networks*",".{0,1000}\\Program\sFiles\s\(x86\)\\Atera\sNetworks.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\Barracuda RMM\*",".{0,1000}\\Program\sFiles\s\(x86\)\\Barracuda\sRMM\\.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\program files (x86)\gotomypc\g2tray.exe*",".{0,1000}\\program\sfiles\s\(x86\)\\gotomypc\\g2tray\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\ITarian\Endpoint Manager\*",".{0,1000}\\Program\sFiles\s\(x86\)\\ITarian\\Endpoint\sManager\\.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\ITarian\RemoteControl\*",".{0,1000}\\Program\sFiles\s\(x86\)\\ITarian\\RemoteControl\\.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\Level Platforms\*",".{0,1000}\\Program\sFiles\s\(x86\)\\Level\sPlatforms\\.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\Level\*",".{0,1000}\\Program\sFiles\s\(x86\)\\Level\\.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files (x86)\RemotePC\*",".{0,1000}\\Program\sFiles\s\(x86\)\\RemotePC\\.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\program files (x86)\remotepc\remotepcperformance\*",".{0,1000}\\program\sfiles\s\(x86\)\\remotepc\\remotepcperformance\\.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Advanced Monitoring Agent\*",".{0,1000}\\Program\sFiles\\Advanced\sMonitoring\sAgent\\.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Atera Networks*",".{0,1000}\\Program\sFiles\\Atera\sNetworks.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Aweray*",".{0,1000}\\Program\sFiles\\Aweray.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Barracuda RMM\*",".{0,1000}\\Program\sFiles\\Barracuda\sRMM\\.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Level Platforms\*",".{0,1000}\\Program\sFiles\\Level\sPlatforms\\.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Level\level.db*",".{0,1000}\\Program\sFiles\\Level\\level\.db.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Level\osqueryi.exe*",".{0,1000}\\Program\sFiles\\Level\\osqueryi\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Level\winpty.dll*",".{0,1000}\\Program\sFiles\\Level\\winpty\.dll.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\Level\winpty-agent.exe*",".{0,1000}\\Program\sFiles\\Level\\winpty\-agent\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\SubDir\Client.exe*",".{0,1000}\\Program\sFiles\\SubDir\\Client\.exe.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\Program Files\Supremo\*",".{0,1000}\\Program\sFiles\\Supremo\\.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Program Files\TacticalAgent\*",".{0,1000}\\Program\sFiles\\TacticalAgent\\.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\Program Files\TeamViewer*",".{0,1000}\\Program\sFiles\\TeamViewer.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\Aeroadmin\*",".{0,1000}\\ProgramData\\Aeroadmin\\.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","C:\ProgramData\Aeroadmin\log.json","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\AMMYY\*",".{0,1000}\\ProgramData\\AMMYY\\.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\Anyplace Control *",".{0,1000}\\ProgramData\\Anyplace\sControl\s.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\Barracuda MSP\*",".{0,1000}\\ProgramData\\Barracuda\sMSP\\.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\programdata\bomgar-scc-*",".{0,1000}\\programdata\\bomgar\-scc\-.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\LogMeIn\*",".{0,1000}\\ProgramData\\LogMeIn\\.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\Remote Utilities*",".{0,1000}\\ProgramData\\Remote\sUtilities.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\RemotePC*",".{0,1000}\\ProgramData\\RemotePC.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\RustDesk\*",".{0,1000}\\ProgramData\\RustDesk\\.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\ProgramData\SupremoRemoteDesktop*",".{0,1000}\\ProgramData\\SupremoRemoteDesktop.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ProgramData\TacticalRMM\*",".{0,1000}\\ProgramData\\TacticalRMM\\.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\ProgramFile*\previous-version",".{0,1000}\\ProgramFile.{0,40}\\previous-version","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","old anydesk version after update","10","10","N/A","N/A","N/A","N/A"
"*\Programs\GoToMyPC.lnk*",".{0,1000}\\Programs\\GoToMyPC\.lnk.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Programs\SimpleHelp Remote Work""*",".{0,1000}\\Programs\\SimpleHelp\sRemote\sWork\"".{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Programs\SimpleHelp Technician*",".{0,1000}\\Programs\\SimpleHelp\sTechnician.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Programs\TightVNC*",".{0,1000}\\Programs\\TightVNC.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Pulseway Remote Control\*",".{0,1000}\\Pulseway\sRemote\sControl\\.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Pulseway\*",".{0,1000}\\Pulseway\\.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pulseway_x64.deb*",".{0,1000}\\pulseway_x64\.deb.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Pulseway_x64.msi*",".{0,1000}\\Pulseway_x64\.msi.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pulseway_x86.deb*",".{0,1000}\\pulseway_x86\.deb.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\PulsewayServiceCheck*",".{0,1000}\\PulsewayServiceCheck.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\pwyrc-agent.dll*",".{0,1000}\\pwyrc\-agent\.dll.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\pwy-rd\shell\open\command*",".{0,1000}\\pwy\-rd\\shell\\open\\command.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Quasar.Client\*",".{0,1000}\\Quasar\.Client\\.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\Quasar.Common\*.cs*",".{0,1000}\\Quasar\.Common\\.{0,1000}\.cs.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\quasar.p12*",".{0,1000}\\quasar\.p12.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\Quasar.v*.zip*",".{0,1000}\\Quasar\.v.{0,1000}\.zip.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\Quasar-master*",".{0,1000}\\Quasar\-master.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\Quick Assist Installer.exe*",".{0,1000}\\Quick\sAssist\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\quick launch\dameware remote everywhere tech console.lnk*",".{0,1000}\\quick\slaunch\\dameware\sremote\severywhere\stech\sconsole\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\QuickAssist.exe*",".{0,1000}\\QuickAssist\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\QuickAssist.pdb*",".{0,1000}\\QuickAssist\.pdb.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\ractrlkeyhook.dll*",".{0,1000}\\ractrlkeyhook\.dll.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Radmin.exe*",".{0,1000}\\Radmin\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RADMIN.EXE-*.pf*",".{0,1000}\\RADMIN\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Radmin\radmin.rpb*",".{0,1000}\\Radmin\\radmin\.rpb.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Radmin_Server_*.msi*",".{0,1000}\\Radmin_Server_.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Radmin_Viewer_*.msi*",".{0,1000}\\Radmin_Viewer_.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Radmin_VPN_1.*.exe*",".{0,1000}\\Radmin_VPN_1\..{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remote access session.exe*",".{0,1000}\\remote\saccess\ssession\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remote access.exe*",".{0,1000}\\remote\saccess\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote AccessEmbedExample.html*",".{0,1000}\\Remote\sAccessEmbedExample\.html.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote Access-java-online.jar*",".{0,1000}\\Remote\sAccess\-java\-online\.jar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remote support.exe*",".{0,1000}\\remote\ssupport\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote SupportEmbedExample.html*",".{0,1000}\\Remote\sSupportEmbedExample\.html.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remote utilities - host\*",".{0,1000}\\remote\sutilities\s\-\shost\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote Utilities - Host\*",".{0,1000}\\Remote\sUtilities\s\-\sHost\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remote utilities agent\*",".{0,1000}\\remote\sutilities\sagent\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote Utilities Agent\Logs*",".{0,1000}\\Remote\sUtilities\sAgent\\Logs.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote Utilities Files\rdp_connections\*",".{0,1000}\\Remote\sUtilities\sFiles\\rdp_connections\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote Utilities Server\*",".{0,1000}\\Remote\sUtilities\sServer\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote Utilities\Logs*",".{0,1000}\\Remote\sUtilities\\Logs.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote Utilities\MiniInternetId*",".{0,1000}\\Remote\sUtilities\\MiniInternetId.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\remote_assistance_host.exe*",".{0,1000}\\remote_assistance_host\.exe.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Remote_Control_by_ITarian_*.log*",".{0,1000}\\Remote_Control_by_ITarian_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remoteaccess-jar-with-dependencies.jar*",".{0,1000}\\remoteaccess\-jar\-with\-dependencies\.jar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remotecontrol\rcontrol.exe*",".{0,1000}\\remotecontrol\\rcontrol\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remotecontrol\rviewer.exe*",".{0,1000}\\remotecontrol\\rviewer\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemoteControlbyITarian (3).exe*",".{0,1000}\\RemoteControlbyITarian\s\(3\)\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemoteControlbyITarian_(3).exe*",".{0,1000}\\RemoteControlbyITarian_\(3\)\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemoteControlSetup.exe*",".{0,1000}\\RemoteControlSetup\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemoteDesktop.exe*",".{0,1000}\\RemoteDesktop\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemoteDesktop_x64.msi*",".{0,1000}\\RemoteDesktop_x64\.msi.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC (1).exe*",".{0,1000}\\RemotePC\s\(1\)\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC Attended.lnk*",".{0,1000}\\RemotePC\sAttended\.lnk.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC Attended\*",".{0,1000}\\RemotePC\sAttended\\.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC Performance Host\*",".{0,1000}\\RemotePC\sPerformance\sHost\\.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC.Common.dll*",".{0,1000}\\RemotePC\.Common\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC.exe*",".{0,1000}\\RemotePC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC.exe*",".{0,1000}\\RemotePC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC.lnk*",".{0,1000}\\RemotePC\.lnk.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC.tmp*",".{0,1000}\\RemotePC\.tmp.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC.tmp*",".{0,1000}\\RemotePC\.tmp.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePC\*.dll*",".{0,1000}\\RemotePC\\.{0,1000}\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCAttended.dmg*",".{0,1000}\\RemotePCAttended\.dmg.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCCopyPaste.txt*",".{0,1000}\\RemotePCCopyPaste\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCDDriver.cat*",".{0,1000}\\RemotePCDDriver\.cat.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCDDriver.inf*",".{0,1000}\\RemotePCDDriver\.inf.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCDDriverumode1_0.dll*",".{0,1000}\\RemotePCDDriverumode1_0\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCDDriverumode1_2.dll*",".{0,1000}\\RemotePCDDriverumode1_2\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCDesktop.txt*",".{0,1000}\\RemotePCDesktop\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCDnD.dll*",".{0,1000}\\RemotePCDnD\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCDnDLauncher.exe*",".{0,1000}\\RemotePCDnDLauncher\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCHDDesktop.txt*",".{0,1000}\\RemotePCHDDesktop\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCHDService.txt*",".{0,1000}\\RemotePCHDService\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remotepclauncher.exe*",".{0,1000}\\remotepclauncher\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCModules.log*",".{0,1000}\\RemotePCModules\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPDF.conf*",".{0,1000}\\RemotePCPDF\.conf.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPerformancePlugins.exe*",".{0,1000}\\RemotePCPerformancePlugins\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPrinter.exe*",".{0,1000}\\RemotePCPrinter\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPrinter.exe.config*",".{0,1000}\\RemotePCPrinter\.exe\.config.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPrinter.pdb*",".{0,1000}\\RemotePCPrinter\.pdb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPrinterCore.dll*",".{0,1000}\\RemotePCPrinterCore\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPrinterCore.pdb*",".{0,1000}\\RemotePCPrinterCore\.pdb.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCProxys.dat*",".{0,1000}\\RemotePCProxys\.dat.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPS5UI.DLL*",".{0,1000}\\RemotePCPS5UI\.DLL.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPS5UI.DLL*",".{0,1000}\\RemotePCPS5UI\.DLL.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPSCRIPT.*",".{0,1000}\\RemotePCPSCRIPT\..{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPSCRIPT.HLP*",".{0,1000}\\RemotePCPSCRIPT\.HLP.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPSCRIPT.NTF*",".{0,1000}\\RemotePCPSCRIPT\.NTF.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCPSCRIPT5.DLL*",".{0,1000}\\RemotePCPSCRIPT5\.DLL.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCService.exe*",".{0,1000}\\RemotePCService\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCService.txt*",".{0,1000}\\RemotePCService\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCService_2.txt*",".{0,1000}\\RemotePCService_2\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCSuite.dmg*",".{0,1000}\\RemotePCSuite\.dmg.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCUDE.cat*",".{0,1000}\\RemotePCUDE\.cat.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCUDE.inf*",".{0,1000}\\RemotePCUDE\.inf.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCUDE.sys*",".{0,1000}\\RemotePCUDE\.sys.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCUDEHost.cat*",".{0,1000}\\RemotePCUDEHost\.cat.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCUDEHost.inf*",".{0,1000}\\RemotePCUDEHost\.inf.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCUDEHost.sys*",".{0,1000}\\RemotePCUDEHost\.sys.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCUIA.exe*",".{0,1000}\\RemotePCUIA\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCUIU.exe*",".{0,1000}\\RemotePCUIU\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remotepcuiu.exe*",".{0,1000}\\remotepcuiu\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemotePCViewer.msi*",".{0,1000}\\RemotePCViewer\.msi.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RemoteSupport\127.0.0.1.tvc*",".{0,1000}\\RemoteSupport\\127\.0\.0\.1\.tvc.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\remoting_desktop.exe*",".{0,1000}\\remoting_desktop\.exe.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remoting_host.exe*",".{0,1000}\\remoting_host\.exe.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remoting_native_messaging_host.exe*",".{0,1000}\\remoting_native_messaging_host\.exe.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\remoting_start_host.exe*",".{0,1000}\\remoting_start_host\.exe.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RescueWinRTLib.dll*",".{0,1000}\\RescueWinRTLib\.dll.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RescueWinRTLib.dll*",".{0,1000}\\RescueWinRTLib\.dll.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rfusclient.exe*",".{0,1000}\\rfusclient\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rmm-client-site-server.exe*",".{0,1000}\\rmm\-client\-site\-server\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\rmm-client-site-server.exe*",".{0,1000}\\rmm\-client\-site\-server\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\rmm-installer.ps1*",".{0,1000}\\rmm\-installer\.ps1.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\RmmService.exe*",".{0,1000}\\RmmService\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Root\InventoryApplicationFile\support-logmeinr*",".{0,1000}\\Root\\InventoryApplicationFile\\support\-logmeinr.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Root\InventoryApplicationFile\za_connect.exe*",".{0,1000}\\Root\\InventoryApplicationFile\\za_connect\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RpcAccessPermissionNotifier.exe*",".{0,1000}\\RpcAccessPermissionNotifier\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RpcApp\RPCCodecEngine.exe*",".{0,1000}\\RpcApp\\RPCCodecEngine\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RpcApp\Tools\Chat.exe*",".{0,1000}\\RpcApp\\Tools\\Chat\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RpcApp\Tools\TransferServer.exe*",".{0,1000}\\RpcApp\\Tools\\TransferServer\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCAppLauncherLogFile.txt*",".{0,1000}\\RPCAppLauncherLogFile\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCAttended.log*",".{0,1000}\\RPCAttended\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCAttendedAdmin.exe*",".{0,1000}\\RPCAttendedAdmin\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCCertificate.log*",".{0,1000}\\RPCCertificate\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCClipboard.exe*",".{0,1000}\\RPCClipboard\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCClipboardAttended.exe*",".{0,1000}\\RPCClipboardAttended\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCConfig.ini*",".{0,1000}\\RPCConfig\.ini.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCCoreViewer.exe*",".{0,1000}\\RPCCoreViewer\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RpcDND_Console.exe*",".{0,1000}\\RpcDND_Console\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCDownloader.exe*",".{0,1000}\\RPCDownloader\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCDownloaderLogFile.txt*",".{0,1000}\\RPCDownloaderLogFile\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCDragDrop.txt*",".{0,1000}\\RPCDragDrop\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCFirewallAttended.exe*",".{0,1000}\\RPCFirewallAttended\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCFireWallRule.exe*",".{0,1000}\\RPCFireWallRule\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCFireWallRulelogfile.txt*",".{0,1000}\\RPCFireWallRulelogfile\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCKeyMouseHandler.txt*",".{0,1000}\\RPCKeyMouseHandler\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTABootstrapper.exe*",".{0,1000}\\RPCOTABootstrapper\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTADesktop.exe*",".{0,1000}\\RPCOTADesktop\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTADesktopUAC.exe*",".{0,1000}\\RPCOTADesktopUAC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RpcOTADND_Console.exe*",".{0,1000}\\RpcOTADND_Console\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTAElevator.exe*",".{0,1000}\\RPCOTAElevator\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTAFTHost.exe*",".{0,1000}\\RPCOTAFTHost\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTAKillService.exe*",".{0,1000}\\RPCOTAKillService\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTARelauncher.exe*",".{0,1000}\\RPCOTARelauncher\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTAService.exe*",".{0,1000}\\RPCOTAService\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTAServiceUAC.exe*",".{0,1000}\\RPCOTAServiceUAC\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTAUtilityHost.exe*",".{0,1000}\\RPCOTAUtilityHost\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCOTAViewerHostKeyPopup.exe*",".{0,1000}\\RPCOTAViewerHostKeyPopup\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPerformanceService.exe*",".{0,1000}\\RPCPerformanceService\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPerformanceService.log*",".{0,1000}\\RPCPerformanceService\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPerfViewer.exe*",".{0,1000}\\RPCPerfViewer\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rpcperfviewer.exe*",".{0,1000}\\rpcperfviewer\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPerfViewer.log*",".{0,1000}\\RPCPerfViewer\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPing.txt*",".{0,1000}\\RPCPing\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPreUninstall.log*",".{0,1000}\\RPCPreUninstall\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPreUninstall.log*",".{0,1000}\\RPCPreUninstall\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPrinterDownloader.exe*",".{0,1000}\\RPCPrinterDownloader\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCPrinterDownloader.txt*",".{0,1000}\\RPCPrinterDownloader\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCProxyLatency.exe*",".{0,1000}\\RPCProxyLatency\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCProxyLatencyAttended.exe*",".{0,1000}\\RPCProxyLatencyAttended\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCSettings.ini*",".{0,1000}\\RPCSettings\.ini.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RpcStickyNotes.exe*",".{0,1000}\\RpcStickyNotes\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCSuite_*_Inc.log*",".{0,1000}\\RPCSuite_.{0,1000}_Inc\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RPCsuiteLaunch.txt*",".{0,1000}\\RPCsuiteLaunch\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rserver3.exe*",".{0,1000}\\rserver3\.exe.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rsetup64.exe*/stop*",".{0,1000}\\rsetup64\.exe.{0,1000}\/stop.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rsl.exe /setup*",".{0,1000}\\rsl\.exe\s\/setup.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rsl.exe*/stop*",".{0,1000}\\rsl\.exe.{0,1000}\/stop.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RSTemp\ZohoMeeting\*",".{0,1000}\\RSTemp\\ZohoMeeting\\.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\RunOnce\*LogMeInRescue_*",".{0,1000}\\RunOnce\\.{0,1000}LogMeInRescue_.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rustdesk-*-x86_64.exe*",".{0,1000}\\rustdesk\-.{0,1000}\-x86_64\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\RustDesk.exe*",".{0,1000}\\RustDesk\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\RustDesk.lnk*",".{0,1000}\\RustDesk\.lnk.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\RustDesk\query*",".{0,1000}\\RustDesk\\query.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","named pipe","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\RustDeskIddDriver\*",".{0,1000}\\RustDeskIddDriver\\.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\rutserv.exe*",".{0,1000}\\rutserv\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\rutview.exe*",".{0,1000}\\rutview\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ru-viewer-portable\*",".{0,1000}\\ru\-viewer\-portable\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Safeboot\Network\AltMeshAgent*",".{0,1000}\\Safeboot\\Network\\AltMeshAgent.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\SafeBoot\Network\ShTemporaryService*",".{0,1000}\\SafeBoot\\Network\\ShTemporaryService.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\SafeBoot\Network\SimpleHelp Server*",".{0,1000}\\SafeBoot\\Network\\SimpleHelp\sServer.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\SafeBoot\Network\Zoho Assist-Remote Support*",".{0,1000}\\SafeBoot\\Network\\Zoho\sAssist\-Remote\sSupport.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Schedule\TaskCache\Tree\RemotePC*",".{0,1000}\\Schedule\\TaskCache\\Tree\\RemotePC.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect Client (*",".{0,1000}\\ScreenConnect\sClient\s\(.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect.Client.exe*",".{0,1000}\\ScreenConnect\.Client\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","screenconnect.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect.ClientService.exe*",".{0,1000}\\ScreenConnect\.ClientService\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect.ClientSetup.exe*",".{0,1000}\\ScreenConnect\.ClientSetup\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect.Core.dll*",".{0,1000}\\ScreenConnect\.Core\.dll.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect.InstallerActions.dll*",".{0,1000}\\ScreenConnect\.InstallerActions\.dll.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect.Windows.dll*",".{0,1000}\\ScreenConnect\.Windows\.dll.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect.WindowsBackstageShell.exe*",".{0,1000}\\ScreenConnect\.WindowsBackstageShell\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect.WindowsClient.exe*",".{0,1000}\\ScreenConnect\.WindowsClient\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ScreenConnect\Bin\*",".{0,1000}\\ScreenConnect\\Bin\\.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Scripts\CreateRegKey.scp*",".{0,1000}\\Scripts\\CreateRegKey\.scp.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Scripts\DirLst.log*",".{0,1000}\\Scripts\\DirLst\.log.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Scripts\DirLst.scp*",".{0,1000}\\Scripts\\DirLst\.scp.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Scripts\DrvSize.scp*",".{0,1000}\\Scripts\\DrvSize\.scp.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Scripts\writetofile.scp*",".{0,1000}\\Scripts\\writetofile\.scp.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Service Install Overwrite Remote CFG*",".{0,1000}\\Service\sInstall\sOverwrite\sRemote\sCFG.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\Services\AteraAgent*",".{0,1000}\\Services\\AteraAgent.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Services\DWAgent*",".{0,1000}\\Services\\DWAgent.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\Services\EventLog\Application\UltraVNC\*",".{0,1000}\\Services\\EventLog\\Application\\UltraVNC\\.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*\Services\EventLog\Application\VSA X*",".{0,1000}\\Services\\EventLog\\Application\\VSA\sX.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Services\EventLog\Application\VSAX*",".{0,1000}\\Services\\EventLog\\Application\\VSAX.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Services\RemotePCAttendedService*",".{0,1000}\\Services\\RemotePCAttendedService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Services\SimpleHelp Server*",".{0,1000}\\Services\\SimpleHelp\sServer.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Services\TeamViewer\*",".{0,1000}\\Services\\TeamViewer\\.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","#registry","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\SFT: Enable Simple File Transfer*",".{0,1000}\\SFT\:\sEnable\sSimple\sFile\sTransfer.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\simplegateway.service""*",".{0,1000}\\simplegateway\.service\"".{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SimpleHelp TechnicianEmbedExample.html*",".{0,1000}\\SimpleHelp\sTechnicianEmbedExample\.html.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SimpleHelp.RemoteWork.127_0_0_1*",".{0,1000}\\SimpleHelp\.RemoteWork\.127_0_0_1.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\SimpleHelp.Technician.127_0_0_1*",".{0,1000}\\SimpleHelp\.Technician\.127_0_0_1.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\simplehelper64.exe*",".{0,1000}\\simplehelper64\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\simplehelp-rw\shell*",".{0,1000}\\simplehelp\-rw\\shell.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\simplehelpuninstall.exe*",".{0,1000}\\simplehelpuninstall\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SimpleService.exe*",".{0,1000}\\SimpleService\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\slave\workspace\GIT_WIN_SRS_Formal\Source\irisserver\*",".{0,1000}\\slave\\workspace\\GIT_WIN_SRS_Formal\\Source\\irisserver\\.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Ammyy\Admin*",".{0,1000}\\SOFTWARE\\Ammyy\\Admin.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Software\AweSun\SunLogin\SunloginClient*",".{0,1000}\\Software\\AweSun\\SunLogin\\SunloginClient.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Clients\Media\AnyDesk*",".{0,1000}\\SOFTWARE\\Clients\\Media\\AnyDesk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-003/","1","0","#registry","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\ITarian\RemoteControl*",".{0,1000}\\SOFTWARE\\ITarian\\RemoteControl.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Kaseya\*",".{0,1000}\\SOFTWARE\\Kaseya\\.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Level Platforms\Managed Workplace\*",".{0,1000}\\SOFTWARE\\Level\sPlatforms\\Managed\sWorkplace\\.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Software\LogMeInRescue\*",".{0,1000}\\Software\\LogMeInRescue\\.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Microsoft\Tracing\PCMonitorSrv_RAS*",".{0,1000}\\SOFTWARE\\Microsoft\\Tracing\\PCMonitorSrv_RAS.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Microsoft\Tracing\Quick Assist Installer*",".{0,1000}\\SOFTWARE\\Microsoft\\Tracing\\Quick\sAssist\sInstaller.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","#registry","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\Software\NetSupport Ltd\*",".{0,1000}\\Software\\NetSupport\sLtd\\.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\ORL\VNCHooks\Application_Prefs\WinVNC*",".{0,1000}\\SOFTWARE\\ORL\\VNCHooks\\Application_Prefs\\WinVNC.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Supremo\*",".{0,1000}\\SOFTWARE\\Supremo\\.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Software\Supremo\Printer\*",".{0,1000}\\Software\\Supremo\\Printer\\.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Software\TeamViewer\Temp*",".{0,1000}\\Software\\TeamViewer\\Temp.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","#registry","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Usoris\Remote Utilities\*",".{0,1000}\\SOFTWARE\\Usoris\\Remote\sUtilities\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\WOW6432Node\ITarian\ITSM\*",".{0,1000}\\SOFTWARE\\WOW6432Node\\ITarian\\ITSM\\.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\WOW6432Node\Supremo\*",".{0,1000}\\SOFTWARE\\WOW6432Node\\Supremo\\.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\WOW6432Node\TightVNC\*",".{0,1000}\\SOFTWARE\\WOW6432Node\\TightVNC\\.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\SOFTWARE\Zoho Assist*",".{0,1000}\\SOFTWARE\\Zoho\sAssist.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.DepInjectedClassWalker.dll*",".{0,1000}\\SolarWinds\.DepInjectedClassWalker\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Diags.Contract.dll*",".{0,1000}\\SolarWinds\.Diags\.Contract\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Diags.DameWare.Extensions.dll*",".{0,1000}\\SolarWinds\.Diags\.DameWare\.Extensions\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Diags.exe*",".{0,1000}\\SolarWinds\.Diags\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Diags.exe.config*",".{0,1000}\\SolarWinds\.Diags\.exe\.config.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Diags.Extensions.Common.dll*",".{0,1000}\\SolarWinds\.Diags\.Extensions\.Common\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Diags.Extensions.dll*",".{0,1000}\\SolarWinds\.Diags\.Extensions\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Diags.Platform.Extensions.dll*",".{0,1000}\\SolarWinds\.Diags\.Platform\.Extensions\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Diags.Strings.dll*",".{0,1000}\\SolarWinds\.Diags\.Strings\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SOLARWINDS.DRS.LICENSOR.EXE-*",".{0,1000}\\SOLARWINDS\.DRS\.LICENSOR\.EXE\-.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.LicenseManager.msi*",".{0,1000}\\SolarWinds\.LicenseManager\.msi.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Licensing.Gen4.dll*",".{0,1000}\\SolarWinds\.Licensing\.Gen4\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Licensing.Gen4.dll.config*",".{0,1000}\\SolarWinds\.Licensing\.Gen4\.dll\.config.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Licensing.Gen4.Resources.dll*",".{0,1000}\\SolarWinds\.Licensing\.Gen4\.Resources\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Licensing.Gen4.UI.dll*",".{0,1000}\\SolarWinds\.Licensing\.Gen4\.UI\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Licensing.MRC.COMWrapper.dll*",".{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Licensing.MRC.COMWrapper.dll.config*",".{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.dll\.config.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Licensing.MRC.COMWrapper.tlb*",".{0,1000}\\SolarWinds\.Licensing\.MRC\.COMWrapper\.tlb.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Logging.dll*",".{0,1000}\\SolarWinds\.Logging\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.MRC.Licensor.exe*",".{0,1000}\\SolarWinds\.MRC\.Licensor\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.MRC.Licensor.exe*",".{0,1000}\\SolarWinds\.MRC\.Licensor\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.MRC.Licensor.exe.config*",".{0,1000}\\SolarWinds\.MRC\.Licensor\.exe\.config.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.MRC.Licensor.log*",".{0,1000}\\SolarWinds\.MRC\.Licensor\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Pluggability.Contract.dll*",".{0,1000}\\SolarWinds\.Pluggability\.Contract\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds.Pluggability.dll*",".{0,1000}\\SolarWinds\.Pluggability\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds\Dameware Mini Remote Control*",".{0,1000}\\SolarWinds\\Dameware\sMini\sRemote\sControl.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds\Logs\Dameware*",".{0,1000}\\SolarWinds\\Logs\\Dameware.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*\SOLARWINDS-DAMEWARE-DRS-ST.EX-*",".{0,1000}\\SOLARWINDS\-DAMEWARE\-DRS\-ST\.EX\-.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\SolarWinds-Dameware-DRS-St.exe*",".{0,1000}\\SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*\Splashtop Remote\*",".{0,1000}\\Splashtop\sRemote\\.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Splashtop\Temp\*",".{0,1000}\\Splashtop\\Temp\\.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Splashtop\Temp\log\FTCLog.txt*",".{0,1000}\\Splashtop\\Temp\\log\\FTCLog\.txt.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\spool\drivers\x64\rupd.*",".{0,1000}\\spool\\drivers\\x64\\rupd\..{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SRService.exe*",".{0,1000}\\SRService\.exe.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\start dameware remote everywhere agent.lnk*",".{0,1000}\\start\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Start Menu\Programs\Advanced Monitoring Agent.lnk*",".{0,1000}\\Start\sMenu\\Programs\\Advanced\sMonitoring\sAgent\.lnk.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\start menu\programs\dameware*",".{0,1000}\\start\smenu\\programs\\dameware.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Start Menu\Programs\DWAgent*",".{0,1000}\\Start\sMenu\\Programs\\DWAgent.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*\Start Menu\Programs\LogMeIn Rescue\*",".{0,1000}\\Start\sMenu\\Programs\\LogMeIn\sRescue\\.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Start Menu\Programs\LogMeIn*",".{0,1000}\\Start\sMenu\\Programs\\LogMeIn.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Start Menu\Programs\NetSupport*",".{0,1000}\\Start\sMenu\\Programs\\NetSupport.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Start Menu\Programs\Radmin Server *",".{0,1000}\\Start\sMenu\\Programs\\Radmin\sServer\s.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Start Menu\Programs\Radmin Viewer *",".{0,1000}\\Start\sMenu\\Programs\\Radmin\sViewer\s.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\StopSimpleGatewayService.exe*",".{0,1000}\\StopSimpleGatewayService\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\strwinclt.exe*",".{0,1000}\\strwinclt\.exe.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Supremo Remote Printer\*",".{0,1000}\\Supremo\sRemote\sPrinter\\.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Supremo.exe*",".{0,1000}\\Supremo\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SUPREMO.EXE-*.pf*",".{0,1000}\\SUPREMO\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Supremo_Client_2*",".{0,1000}\\Supremo_Client_2.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","pipename","10","10","N/A","N/A","N/A","N/A"
"*\Supremo_Helper_2*",".{0,1000}\\Supremo_Helper_2.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","pipename","10","10","N/A","N/A","N/A","N/A"
"*\Supremo_Service*",".{0,1000}\\Supremo_Service.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","pipename","10","10","N/A","N/A","N/A","N/A"
"*\SupremoHelper.exe*",".{0,1000}\\SupremoHelper\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SupremoRemoteDesktop\*",".{0,1000}\\SupremoRemoteDesktop\\.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\System32\rupdpm.dll*",".{0,1000}\\System32\\rupdpm\.dll.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SysWOW64\rserver30\FamItrf2*",".{0,1000}\\SysWOW64\\rserver30\\FamItrf2.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\SysWOW64\rserver30\FamItrfc*",".{0,1000}\\SysWOW64\\rserver30\\FamItrfc.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tacticalagent-v*-linux-arm.exe*",".{0,1000}\\tacticalagent\-v.{0,1000}\-linux\-arm\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\tacticalagent-v*-windows-amd64.exe*",".{0,1000}\\tacticalagent\-v.{0,1000}\-windows\-amd64\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\tacticalrmm.exe*",".{0,1000}\\tacticalrmm\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\tacticalrmm\*",".{0,1000}\\tacticalrmm\\.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*\TaskCache\Tree\VSA XServiceCheck*",".{0,1000}\\TaskCache\\Tree\\VSA\sXServiceCheck.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Tasks\PulsewayServiceCheck*",".{0,1000}\\Tasks\\PulsewayServiceCheck.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcdirectchat.exe*",".{0,1000}\\tcdirectchat\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcdirectchatde.dll*",".{0,1000}\\tcdirectchatde\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcdirectchaten.dll*",".{0,1000}\\tcdirectchaten\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcdirectchates.dll*",".{0,1000}\\tcdirectchates\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcdirectchatfr.dll*",".{0,1000}\\tcdirectchatfr\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcdirectchatit.dll*",".{0,1000}\\tcdirectchatit\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcdirectchatpt.dll*",".{0,1000}\\tcdirectchatpt\.dll.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcrmtshellagent.exe*",".{0,1000}\\tcrmtshellagent\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcrmtshellagent_*.log*",".{0,1000}\\tcrmtshellagent_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcrmtshellagentmodule_*",".{0,1000}\\tcrmtshellagentmodule_.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcrmtshellviewer.exe*",".{0,1000}\\tcrmtshellviewer\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcrmtshellviewer_*.log*",".{0,1000}\\tcrmtshellviewer_.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tcrmtshellviewermodule_*",".{0,1000}\\tcrmtshellviewermodule_.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\TeamViewer.exe*",".{0,1000}\\TeamViewer\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TeamViewer\Connections.txt*",".{0,1000}\\TeamViewer\\Connections\.txt.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TeamViewer\Connections_incoming.txt*",".{0,1000}\\TeamViewer\\Connections_incoming\.txt.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TeamViewer_.ex*",".{0,1000}\\TeamViewer_\.ex.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\teamviewer_note.exe*",".{0,1000}\\teamviewer_note\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TeamViewerSession\shell\open*",".{0,1000}\\TeamViewerSession\\shell\\open.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TeamViewerTermsOfUseAccepted*",".{0,1000}\\TeamViewerTermsOfUseAccepted.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\Temp\AnyDeskUninst*",".{0,1000}\\Temp\\AnyDeskUninst.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\TEMP\AteraUpgradeAgentPackage\*",".{0,1000}\\TEMP\\AteraUpgradeAgentPackage\\.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Temp\install_windows.exe*",".{0,1000}\\Temp\\install_windows\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\TEMP\ScreenConnect\*.ps1*",".{0,1000}\\TEMP\\ScreenConnect\\.{0,1000}\.ps1.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","screenconnect.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Temp\ScreenConnect\*\setup.msi*",".{0,1000}\\Temp\\ScreenConnect\\.{0,1000}\\setup\.msi.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Temp\SupremoRemoteDesktop*",".{0,1000}\\Temp\\SupremoRemoteDesktop.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Temp\XEOX*",".{0,1000}\\Temp\\XEOX.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\test_rustdesk.log*",".{0,1000}\\test_rustdesk\.log.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*\TightVNC Server*",".{0,1000}\\TightVNC\sServer.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\tightvnc-*",".{0,1000}\\tightvnc\-.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\TightVNC_Service_Control*",".{0,1000}\\TightVNC_Service_Control.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","named pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L2","10","10","N/A","N/A","N/A","N/A"
"*\tkcuploader.exe*",".{0,1000}\\tkcuploader\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Tools\Ninja.WebSockets.dll*",".{0,1000}\\Tools\\Ninja\.WebSockets\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Tracing\RemotePCLauncher_*",".{0,1000}\\Tracing\\RemotePCLauncher_.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\Tracing\RemotePCUIU*",".{0,1000}\\Tracing\\RemotePCUIU.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\TransferClient.exe.config*",".{0,1000}\\TransferClient\.exe\.config.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\TransferServer.exe.config*",".{0,1000}\\TransferServer\.exe\.config.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\TV15Install.log*",".{0,1000}\\TV15Install\.log.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TVExtractTemp\TeamViewer_Resource_*",".{0,1000}\\TVExtractTemp\\TeamViewer_Resource_.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TVExtractTemp\tvfiles.7z*",".{0,1000}\\TVExtractTemp\\tvfiles\.7z.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TvGetVersion.dll*",".{0,1000}\\TvGetVersion\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TVN_log_pipe_public_name*",".{0,1000}\\TVN_log_pipe_public_name.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","named pipe https://github.com/mthcht/awesome-lists/blob/9080701200e4f9f2e523bee7cde7b335121b1cb2/Lists/suspicious_named_pipe_list.csv#L2","10","10","N/A","N/A","N/A","N/A"
"*\TVNetwork.log*",".{0,1000}\\TVNetwork\.log.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\TVWebRTC.dll*",".{0,1000}\\TVWebRTC\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\Two Pilots\Agent\Remote Utilities Printer*",".{0,1000}\\Two\sPilots\\Agent\\Remote\sUtilities\sPrinter.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\ultravnc.cer*",".{0,1000}\\ultravnc\.cer.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\UltraVNC.ini*",".{0,1000}\\UltraVNC\.ini.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\unidrv_rupd.dll*",".{0,1000}\\unidrv_rupd\.dll.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\unidrv_rupd.hlp*",".{0,1000}\\unidrv_rupd\.hlp.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\unidrvui_rupd.dll*",".{0,1000}\\unidrvui_rupd\.dll.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Uninstall\MeshCentralAgent*",".{0,1000}\\Uninstall\\MeshCentralAgent.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*\unires_vpd.dll*",".{0,1000}\\unires_vpd\.dll.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Users\mthcht\AppData\Roaming\SubDir\Client.exe*",".{0,1000}\\Users\\mthcht\\AppData\\Roaming\\SubDir\\Client\.exe.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\Users\Public\Desktop\TVTest.tmp*",".{0,1000}\\Users\\Public\\Desktop\\TVTest\.tmp.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\uvnc bvba\UltraVNC\*",".{0,1000}\\uvnc\sbvba\\UltraVNC\\.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\uvnc_launch.exe*",".{0,1000}\\uvnc_launch\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*\uvnc_settings.ex*",".{0,1000}\\uvnc_settings\.ex.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*\uvnc_settings.exe*",".{0,1000}\\uvnc_settings\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\uvnckeyboardhelper.exe*",".{0,1000}\\uvnckeyboardhelper\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Videos\AnyDesk*",".{0,1000}\\Videos\\AnyDesk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*\ViewerHostKeyPopup.exe*",".{0,1000}\\ViewerHostKeyPopup\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ViewerHostKeyPopup.exe*",".{0,1000}\\ViewerHostKeyPopup\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\viewer-portable-7.2.2.0\*",".{0,1000}\\viewer\-portable\-7\.2\.2\.0\\.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\vncviewer.exe*",".{0,1000}\\vncviewer\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\VPDAgent.exe*",".{0,1000}\\VPDAgent\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\VSA X Manager.lnk*",".{0,1000}\\VSA\sX\sManager\.lnk.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\VSA X Remote Control.lnk*",".{0,1000}\\VSA\sX\sRemote\sControl\.lnk.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\VSA X Remote Control\*",".{0,1000}\\VSA\sX\sRemote\sControl\\.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\VSA X\watchdog.bat*",".{0,1000}\\VSA\sX\\watchdog\.bat.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\VSA XServiceCheck*",".{0,1000}\\VSA\sXServiceCheck.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\VSAX\working*",".{0,1000}\\VSAX\\working.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\VSAX_x64.msi*",".{0,1000}\\VSAX_x64\.msi.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\vsxrc-clip.exe*",".{0,1000}\\vsxrc\-clip\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Win7Taskbar.dll*",".{0,1000}\\Win7Taskbar\.dll.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Windows\Action1\scripts\*",".{0,1000}\\Windows\\Action1\\scripts\\.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Windows\system32\SubDir\Client.exe*",".{0,1000}\\Windows\\system32\\SubDir\\Client\.exe.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*\Windows\SysWOW64\rserver30\*",".{0,1000}\\Windows\\SysWOW64\\rserver30\\.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Windows\Temp\ScreenConnect\*.cmd*",".{0,1000}\\Windows\\Temp\\ScreenConnect\\.{0,1000}\.cmd.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Windows\Temp\ScreenConnect\*.ps1*",".{0,1000}\\Windows\\Temp\\ScreenConnect\\.{0,1000}\.ps1.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Windows\Temp\TeamViewer*",".{0,1000}\\Windows\\Temp\\TeamViewer.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*\WindowsApps\MicrosoftCorporationII.QuickAssist_*",".{0,1000}\\WindowsApps\\MicrosoftCorporationII\.QuickAssist_.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\winpty-agent64.exe*",".{0,1000}\\winpty\-agent64\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\WinSxS\amd64_microsoft-windows-quickassist_*",".{0,1000}\\WinSxS\\amd64_microsoft\-windows\-quickassist_.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*\winvnc.exe*",".{0,1000}\\winvnc\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\winvncsc.exe*",".{0,1000}\\winvncsc\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\winwvc.exe*",".{0,1000}\\winwvc\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\WOW6432Node\Citrix\GoToMyPc*",".{0,1000}\\WOW6432Node\\Citrix\\GoToMyPc.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\wow6432node\multiplicar negocios\bace_dameware*",".{0,1000}\\wow6432node\\multiplicar\snegocios\\bace_dameware.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\WOW6432Node\RemotePC*",".{0,1000}\\WOW6432Node\\RemotePC.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*\WOW6432Node\Splashtop Inc.\Splashtop Remote Server*",".{0,1000}\\WOW6432Node\\Splashtop\sInc\.\\Splashtop\sRemote\sServer.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\x64\monblanking.sys*",".{0,1000}\\x64\\monblanking\.sys.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\XEOX\Agent Watchdog on Boot*",".{0,1000}\\XEOX\\Agent\sWatchdog\son\sBoot.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","#scheduledtask","N/A","10","10","N/A","N/A","N/A","N/A"
"*\XEOX\Agent Watchdog on Wakeup*",".{0,1000}\\XEOX\\Agent\sWatchdog\son\sWakeup.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","#scheduledtask","N/A","10","10","N/A","N/A","N/A","N/A"
"*\XEOX\Agent Watchdog*",".{0,1000}\\XEOX\\Agent\sWatchdog.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","#scheduledtask","N/A","10","10","N/A","N/A","N/A","N/A"
"*\XEOX_cloud_agent_install.bat*",".{0,1000}\\XEOX_cloud_agent_install\.bat.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\XEOXAgent.exe*",".{0,1000}\\XEOXAgent\.exe.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\xeox-agent_x64\*",".{0,1000}\\xeox\-agent_x64\\.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZA_Connect.exe*",".{0,1000}\\ZA_Connect\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZA_Upgrader*",".{0,1000}\\ZA_Upgrader.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZAAudioClient.exe*",".{0,1000}\\ZAAudioClient\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZAFileTransfer.exe*",".{0,1000}\\ZAFileTransfer\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZAService.exe*",".{0,1000}\\ZAService\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZAudioClientPipe_*ServerReadPipe*",".{0,1000}\\ZAudioClientPipe_.{0,1000}ServerReadPipe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZAudioClientPipe_*ServerWritePipe*",".{0,1000}\\ZAudioClientPipe_.{0,1000}ServerWritePipe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZMAgent.exe*",".{0,1000}\\ZMAgent\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\Zoho Assist\Zoho Assist Remote support*",".{0,1000}\\Zoho\sAssist\\Zoho\sAssist\sRemote\ssupport.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoMeeting.7z*",".{0,1000}\\ZohoMeeting\.7z.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoMeeting.exe*",".{0,1000}\\ZohoMeeting\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoMeeting\agent.exe*",".{0,1000}\\ZohoMeeting\\agent\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\zohomeeting\agent.exe*",".{0,1000}\\zohomeeting\\agent\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoMeeting\agent_ui.exe*",".{0,1000}\\ZohoMeeting\\agent_ui\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoMeeting\Connect.exe*",".{0,1000}\\ZohoMeeting\\Connect\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoMeeting\Connection.conf*",".{0,1000}\\ZohoMeeting\\Connection\.conf.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoMeeting\log\*.log*",".{0,1000}\\ZohoMeeting\\log\\.{0,1000}\.log.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoMeeting\ViewerUI.exe*",".{0,1000}\\ZohoMeeting\\ViewerUI\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoTray.exe*",".{0,1000}\\ZohoTray\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoURS.exe*",".{0,1000}\\ZohoURS\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*\ZohoURSService.exe*",".{0,1000}\\ZohoURSService\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*_Classes\zohoassistlaunchv2*",".{0,1000}_Classes\\zohoassistlaunchv2.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*_NetSupport_NetSupport Manager_*",".{0,1000}_NetSupport_NetSupport\sManager_.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*_renamed_by_Action1*",".{0,1000}_renamed_by_Action1.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<\Level\Level Watchdog>*",".{0,1000}\<\\Level\\Level\sWatchdog\>.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<a href=""rutils:*",".{0,1000}\<a\shref\=\""rutils\:.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Alpemix>*",".{0,1000}\<Alpemix\>.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<AlpemixWEB>*",".{0,1000}\<AlpemixWEB\>.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<data>dameware remote everywhere</data>*",".{0,1000}\<data\>dameware\sremote\severywhere\<\/data\>.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Installed GoToMyPC</Data>*",".{0,1000}\<Data\>Installed\sGoToMyPC\<\/Data\>.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>LogMeIn, Inc.</Data>*",".{0,1000}\<Data\>LogMeIn,\sInc\.\<\/Data\>.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<data>n-able take control</data>*",".{0,1000}\<data\>n\-able\stake\scontrol\<\/data\>.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Product: Chrome Remote Desktop Host*",".{0,1000}\<Data\>Product\:\sChrome\sRemote\sDesktop\sHost.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","#productname","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Product: Remote Utilities - Host -- *",".{0,1000}\<Data\>Product\:\sRemote\sUtilities\s\-\sHost\s\-\-\s.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Pulseway Remote Control</Data>*",".{0,1000}\<Data\>Pulseway\sRemote\sControl\<\/Data\>.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Received Request Execute automation * script * from device Id*",".{0,1000}\<Data\>Received\sRequest\sExecute\sautomation\s.{0,1000}\sscript\s.{0,1000}\sfrom\sdevice\sId.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Received Request Get RD pool score *pulseway.com/remote*",".{0,1000}\<Data\>Received\sRequest\sGet\sRD\spool\sscore\s.{0,1000}pulseway\.com\/remote.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Remote Utilities - Host</Data>*",".{0,1000}\<Data\>Remote\sUtilities\s\-\sHost\<\/Data\>.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Remote Utilities Server<*",".{0,1000}\<Data\>Remote\sUtilities\sServer\<.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>Removed Remote Utilities - Host.</Data>*",".{0,1000}\<Data\>Removed\sRemote\sUtilities\s\-\sHost\.\<\/Data\>.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Data>ScreenConnect Software</Data>*",".{0,1000}\<Data\>ScreenConnect\sSoftware\<\/Data\>.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Provider Name=""chromoting"" />*",".{0,1000}\<Provider\sName\=\""chromoting\"".{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","windows event logs application provider name","10","10","N/A","N/A","N/A","N/A"
"*<provider name=""dameware remote everywhere - [dameware]"" />*",".{0,1000}\<provider\sname\=\""dameware\sremote\severywhere\s\-\s\[dameware\]\""\s\/\>.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Provider Name=""PC Monitor"" />*",".{0,1000}\<Provider\sName\=\""PC\sMonitor\""\s\/\>.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Provider Name=""Pulseway"" />*",".{0,1000}\<Provider\sName\=\""Pulseway\""\s\/\>.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Provider Name='Quick Assist'/>*",".{0,1000}\<Provider\sName\=\'Quick\sAssist\'\/\>.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*<Provider Name='ScreenConnect Security Manager'/>*",".{0,1000}\<Provider\sName\=\'ScreenConnect\sSecurity\sManager\'\/\>.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Provider Name='ScreenConnect Web Server'/>*",".{0,1000}\<Provider\sName\=\'ScreenConnect\sWeb\sServer\'\/\>.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*<Teknopars Bilisim>*",".{0,1000}\<Teknopars\sBilisim\>.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*=http://www.gotomypc.com/downloads/viewer *",".{0,1000}\=http\:\/\/www\.gotomypc\.com\/downloads\/viewer\s.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*=NetSupport Client_deleteme*",".{0,1000}\=NetSupport\sClient_deleteme.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Anyplace Control Software<*",".{0,1000}\>Anyplace\sControl\sSoftware\<.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>AnyViewer Setup<*",".{0,1000}\>AnyViewer\sSetup\<.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>AnyViewer<*",".{0,1000}\>AnyViewer\<.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Atera Networks<*",".{0,1000}\>Atera\sNetworks\<.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","#companyname","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Auvik Networks Inc.<*",".{0,1000}\>Auvik\sNetworks\sInc\.\<.{0,1000}","greyware_tool_keyword","auvik","cloud-based network management software","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.auvik.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>AweRay Limited<*",".{0,1000}\>AweRay\sLimited\<.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>AweRay Pte. Ltd.<*",".{0,1000}\>AweRay\sPte\.\sLtd\.\<.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>AweSun.exe<*",".{0,1000}\>AweSun\.exe\<.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>AweSun<*",".{0,1000}\>AweSun\<.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Barracuda MSP<*",".{0,1000}\>Barracuda\sMSP\<.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Barracuda Networks, Inc.*",".{0,1000}\>Barracuda\sNetworks,\sInc\..{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Barracuda RMM Setup AutoRun<*",".{0,1000}\>Barracuda\sRMM\sSetup\sAutoRun\<.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Barracuda RMM Setup<*",".{0,1000}\>Barracuda\sRMM\sSetup\<.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Barracuda RMM*<*",".{0,1000}\>Barracuda\sRMM.{0,1000}\<.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Bomgar Corporation</Data>*","\>Bomgar\sCorporation\<\/Data\>.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>DWAgent<*",".{0,1000}\>DWAgent\<.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*>Famatech Corp.<*",".{0,1000}\>Famatech\sCorp\.\<.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","#companyname","N/A","10","10","N/A","N/A","N/A","N/A"
"*>FleetDeck Inc<*",".{0,1000}\>FleetDeck\sInc\<.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#companyname","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*>Installed Remote Utilities - Viewer.*",".{0,1000}\>Installed\sRemote\sUtilities\s\-\sViewer\..{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Installed Remote Utilities Server.</*",".{0,1000}\>Installed\sRemote\sUtilities\sServer\.\<\/.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Level Software, Inc.<*",".{0,1000}\>Level\sSoftware,\sInc\.\<.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>LPI Level Platforms<*",".{0,1000}\>LPI\sLevel\sPlatforms\<.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Mesh Agent background service<*",".{0,1000}\>Mesh\sAgent\sbackground\sservice\<.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*>Mesh Agent Company<*",".{0,1000}\>Mesh\sAgent\sCompany\<.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*>meshagentRepair<*",".{0,1000}\>meshagentRepair\<.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*>MeshCentral Agent<*",".{0,1000}\>MeshCentral\sAgent\<.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*>MeshCentral<*",".{0,1000}\>MeshCentral\<.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*>NetSupport Client Application</*",".{0,1000}\>NetSupport\sClient\sApplication\<\/.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>NETSUPPORT LTD.</*",".{0,1000}\>NETSUPPORT\sLTD\.\<\/.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>NetSupport Ltd</*",".{0,1000}\>NetSupport\sLtd\<\/.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>NetSupport Remote Control</*",".{0,1000}\>NetSupport\sRemote\sControl\<\/.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>NetSupport remote Control</*",".{0,1000}\>NetSupport\sremote\sControl\<\/.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Product: Remote Utilities - Viewer -- *",".{0,1000}\>Product\:\sRemote\sUtilities\s\-\sViewer\s\-\-\s.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Product: Remote Utilities Server -- *",".{0,1000}\>Product\:\sRemote\sUtilities\sServer\s\-\-\s.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Quick Assist Component<*",".{0,1000}\>Quick\sAssist\sComponent\<.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*>RealVNC<*",".{0,1000}\>RealVNC\<.{0,1000}","greyware_tool_keyword","vncviewer","VNCViewer is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","N/A","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Remote Control by Itarian<*",".{0,1000}\>Remote\sControl\sby\sItarian\<.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Remote device management - https://level.io<*",".{0,1000}\>Remote\sdevice\smanagement\s\-\shttps\:\/\/level\.io\<.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Remote Support Customer Client</Data>*",".{0,1000}\>Remote\sSupport\sCustomer\sClient\<\/Data\>.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Remote Utilities - Viewer</*",".{0,1000}\>Remote\sUtilities\s\-\sViewer\<\/.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>Representative Console</Data>*",".{0,1000}\>Representative\sConsole\<\/Data\>.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>RmmService<*",".{0,1000}\>RmmService\<.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","#servicename","N/A","10","10","N/A","N/A","N/A","N/A"
"*>SimpleHelp Ltd<*",".{0,1000}\>SimpleHelp\sLtd\<.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#companyname","N/A","10","10","N/A","N/A","N/A","N/A"
"*>TightVNC Viewer<*",".{0,1000}\>TightVNC\sViewer\<.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*>UltraVNC VNCViewer<*",".{0,1000}\>UltraVNC\sVNCViewer\<.{0,1000}","greyware_tool_keyword","vncviewer","VNCViewer is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","N/A","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*00:\.vnc\*",".{0,1000}00\:\\\.vnc\\.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*00b377900f7213590db683ce75b4d3ae6053633a5938148afeefd607d0e88319*",".{0,1000}00b377900f7213590db683ce75b4d3ae6053633a5938148afeefd607d0e88319.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*015774ac49fa929ca39c0707aa8177e4605b7df9f53d8630fea1ef5155bb5328*",".{0,1000}015774ac49fa929ca39c0707aa8177e4605b7df9f53d8630fea1ef5155bb5328.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","#filehash","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*017439a15b04aafd322811f9812262e02f5f0bdf2aa252d46a06d7d118dd24f4*",".{0,1000}017439a15b04aafd322811f9812262e02f5f0bdf2aa252d46a06d7d118dd24f4.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0237e84c1a958e0c3bd52228ed33aad0e847d5e72a679381ade503ce1dfddc8b*",".{0,1000}0237e84c1a958e0c3bd52228ed33aad0e847d5e72a679381ade503ce1dfddc8b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*026fd2dd800e84250a19978fc4df8d1c2ff01b61cafdc0aeeb205efb9259fd73*",".{0,1000}026fd2dd800e84250a19978fc4df8d1c2ff01b61cafdc0aeeb205efb9259fd73.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*035a602153cd10af0c370d9863749b006a2590a7c274bb1cb698016a98ccab3f*",".{0,1000}035a602153cd10af0c370d9863749b006a2590a7c274bb1cb698016a98ccab3f.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*035cf1744ffefef60ff711aeae4bcf39cd902e0a581b443553545f6b934f2a71*",".{0,1000}035cf1744ffefef60ff711aeae4bcf39cd902e0a581b443553545f6b934f2a71.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*03A09084-0576-45C5-97CA-B83B1A8688B8*",".{0,1000}03A09084\-0576\-45C5\-97CA\-B83B1A8688B8.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","#GUIDproject","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*03b2d5858587fcf2c5d6f7cdc4a4401318ee63066f936e295f9e94e8c66f0a86*",".{0,1000}03b2d5858587fcf2c5d6f7cdc4a4401318ee63066f936e295f9e94e8c66f0a86.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*045ccab12ac435e6f5a85a15f8109d168193a8370c3a234befa0e960ba609ffa*",".{0,1000}045ccab12ac435e6f5a85a15f8109d168193a8370c3a234befa0e960ba609ffa.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*069a56ca99f366c294536ade1d99de76e68aac6450bdb5f8b59258295bb1ff22*",".{0,1000}069a56ca99f366c294536ade1d99de76e68aac6450bdb5f8b59258295bb1ff22.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*07ae98d2c32434b5ae6382cf43dda0e42ece5e6788be97f07f6262e9b72cb3a8*",".{0,1000}07ae98d2c32434b5ae6382cf43dda0e42ece5e6788be97f07f6262e9b72cb3a8.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*07e837c2ad8be50c19a464a4db64a912acf2e5d5531fdbfe2c4ac5ac008c83ab*",".{0,1000}07e837c2ad8be50c19a464a4db64a912acf2e5d5531fdbfe2c4ac5ac008c83ab.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*095a6fc6a2c9647417df017fa70b182abcc68b97a8addd4e25cf302f6f2e98e4*",".{0,1000}095a6fc6a2c9647417df017fa70b182abcc68b97a8addd4e25cf302f6f2e98e4.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","#filehash","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*095e73fc4b115afd77e39a9389ff1eff6bdbff7a*",".{0,1000}095e73fc4b115afd77e39a9389ff1eff6bdbff7a.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*0a80748ee061b0dc3fef0ecf95abcdcf6554fb09e2f3675fa8f48c43d5582dfa*",".{0,1000}0a80748ee061b0dc3fef0ecf95abcdcf6554fb09e2f3675fa8f48c43d5582dfa.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0b860218a265d58208a132a83dcf04780635337c722caa05cbbd281b32749a91*",".{0,1000}0b860218a265d58208a132a83dcf04780635337c722caa05cbbd281b32749a91.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0bec3d7403f9a089a30003eb12d000cfac25e12e826055d87dd111f3e7bb8559*",".{0,1000}0bec3d7403f9a089a30003eb12d000cfac25e12e826055d87dd111f3e7bb8559.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0c4413aa7e74903ba6c00cd78d60bb9a153d5775949a90d2c794ec00cef7fbd8*",".{0,1000}0c4413aa7e74903ba6c00cd78d60bb9a153d5775949a90d2c794ec00cef7fbd8.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0cbf3ed058d43997b5b034e7c60de64b16ef94a3578358eaf0b4b4a9e6777446*",".{0,1000}0cbf3ed058d43997b5b034e7c60de64b16ef94a3578358eaf0b4b4a9e6777446.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0ce68a99407f300b71cebe379dfa81096726595934a8dcd45360f84dc6c08163*",".{0,1000}0ce68a99407f300b71cebe379dfa81096726595934a8dcd45360f84dc6c08163.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0cfb5b4de55c4affbc5df2d949015300f554d0eca7bb925a79db14997d5c18e2*",".{0,1000}0cfb5b4de55c4affbc5df2d949015300f554d0eca7bb925a79db14997d5c18e2.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0d34f8d272ad4e604c2798ad670d2a2b06d397cc38fa3d84382a16d014c43925*",".{0,1000}0d34f8d272ad4e604c2798ad670d2a2b06d397cc38fa3d84382a16d014c43925.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0DBF152DEAF0B981A8A938D53F769DB8*",".{0,1000}0DBF152DEAF0B981A8A938D53F769DB8.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage - compromised certificate - https://anydesk.com/en/changelog/windows","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","#certificate","compromised certificate","8","8","N/A","N/A","N/A","N/A"
"*0de968ffd4a6c60413cac739dccb1b162f8f93f3db754728fde8738e52706fa4*",".{0,1000}0de968ffd4a6c60413cac739dccb1b162f8f93f3db754728fde8738e52706fa4.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*0f7e030eec92ad940dbdafa3806a0140d7589219d7de05301e8cf622e63683df*",".{0,1000}0f7e030eec92ad940dbdafa3806a0140d7589219d7de05301e8cf622e63683df.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0fdf8c16ffc44fe0006ac5e07721c17a7995c0bcdb4309d3d66697a8f153b402*",".{0,1000}0fdf8c16ffc44fe0006ac5e07721c17a7995c0bcdb4309d3d66697a8f153b402.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*0ffa09304c7f2966f94a1acc5848c0adfa1cdf70525ec51f52722af4624572c3*",".{0,1000}0ffa09304c7f2966f94a1acc5848c0adfa1cdf70525ec51f52722af4624572c3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1078cdf24990c103ac9a35c7081bfdf4ea6d0d62d6c9b1a5624a6ab9c6fcb07b*",".{0,1000}1078cdf24990c103ac9a35c7081bfdf4ea6d0d62d6c9b1a5624a6ab9c6fcb07b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*127ec181a70d665e539d93b8e4a014ce099faf64f0eb790a85158cd5a1349bfd*",".{0,1000}127ec181a70d665e539d93b8e4a014ce099faf64f0eb790a85158cd5a1349bfd.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*128C450F-C8B3-403A-9D0C-E5AD6B7F566F*",".{0,1000}128C450F\-C8B3\-403A\-9D0C\-E5AD6B7F566F.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","#GUIDproject","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*1429e62855ce5572b735fe0460ffa6a8f26d56199a8e166152252c7bd659d275*",".{0,1000}1429e62855ce5572b735fe0460ffa6a8f26d56199a8e166152252c7bd659d275.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","#filehash","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*149ca8b9b2f375a73adf0ae4739f7ab0c83477202c5875ef7f3e2716a087d2ee*",".{0,1000}149ca8b9b2f375a73adf0ae4739f7ab0c83477202c5875ef7f3e2716a087d2ee.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*14CA405B-8BAC-48AB-9FBA-8FB5DF88FD0D*",".{0,1000}14CA405B\-8BAC\-48AB\-9FBA\-8FB5DF88FD0D.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","#GUIDproject","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*151e41e5d547de46a4557bef41a35790951a7926646c7d35d1ed1ef7f9961964*",".{0,1000}151e41e5d547de46a4557bef41a35790951a7926646c7d35d1ed1ef7f9961964.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*157f7d3b048d686f719fdbfe50ee4bc9676d6443211d13cdf0a49b108f1fd6eb*",".{0,1000}157f7d3b048d686f719fdbfe50ee4bc9676d6443211d13cdf0a49b108f1fd6eb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*16813fc81e4ffa28723f54b0d63838e77da5c8e12c13ae73ec949870c440ecfa*",".{0,1000}16813fc81e4ffa28723f54b0d63838e77da5c8e12c13ae73ec949870c440ecfa.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*169fa5bf73c73e2785691de174d40209dfa479430539acbce08eaf24a4cbb0c0*",".{0,1000}169fa5bf73c73e2785691de174d40209dfa479430539acbce08eaf24a4cbb0c0.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*17419f33715f3074f54f71fdaf6e732a28da9961b7143de67e7d91dd6e885191*",".{0,1000}17419f33715f3074f54f71fdaf6e732a28da9961b7143de67e7d91dd6e885191.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*189d2b311c47271dd6c1bed36d8531cdf20e2f21aff699d1fe6d8e29020bde63*",".{0,1000}189d2b311c47271dd6c1bed36d8531cdf20e2f21aff699d1fe6d8e29020bde63.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*18aced79e1431c887174daad2c6076afbd67034fd5ef72042260feffce27a274*",".{0,1000}18aced79e1431c887174daad2c6076afbd67034fd5ef72042260feffce27a274.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*196d1f2b496f00ed154b1ea8884ee7e5938504750c79d9d3e345d47db5499980*",".{0,1000}196d1f2b496f00ed154b1ea8884ee7e5938504750c79d9d3e345d47db5499980.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*1a9fb59e84b29362e747cf4191c4100ccfa6c52fd766eedb831a4169923976eb*",".{0,1000}1a9fb59e84b29362e747cf4191c4100ccfa6c52fd766eedb831a4169923976eb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1b60f0c6902fde29c56d8ef1df0be1b1ba81320c08aeeae8aa34b2f3698c5cae*",".{0,1000}1b60f0c6902fde29c56d8ef1df0be1b1ba81320c08aeeae8aa34b2f3698c5cae.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1ba101f6b07b3194b481dfad27f70bfa23e86a822b49e8c6b3138e57f13614c7*",".{0,1000}1ba101f6b07b3194b481dfad27f70bfa23e86a822b49e8c6b3138e57f13614c7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1bcbac2e969778df504fbe04dd5bfb1e337c141869efdca9c3974e8c97296e18*",".{0,1000}1bcbac2e969778df504fbe04dd5bfb1e337c141869efdca9c3974e8c97296e18.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1c28a3ecf4991146bccfd39ec97c8c060286596c44caedb598feaaf607b277cd*",".{0,1000}1c28a3ecf4991146bccfd39ec97c8c060286596c44caedb598feaaf607b277cd.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1d289b4fb2f8766a1a1e7f8bab7472322f721c1c2f7ecf676f0c9dadfc7f66b3*",".{0,1000}1d289b4fb2f8766a1a1e7f8bab7472322f721c1c2f7ecf676f0c9dadfc7f66b3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1d6101c42021d29583532660865649b7e609b0862e3bd0b164ec794b2953a2f0*",".{0,1000}1d6101c42021d29583532660865649b7e609b0862e3bd0b164ec794b2953a2f0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1d7c4f0e2045835904ee9c994212605d67aef12c7899d8d203039100dc038db7*",".{0,1000}1d7c4f0e2045835904ee9c994212605d67aef12c7899d8d203039100dc038db7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1e5aad914ec6f6fdbb0c0c340ab0e2c336922fba3e556b007d8d5002a6c478ca*",".{0,1000}1e5aad914ec6f6fdbb0c0c340ab0e2c336922fba3e556b007d8d5002a6c478ca.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*1e938fb7b547413a088c96ada20ab163fe27f12d2124aa1cb652f68ec0448970*",".{0,1000}1e938fb7b547413a088c96ada20ab163fe27f12d2124aa1cb652f68ec0448970.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1f2cf255b1a6d9fafad11a2d27bc9471f1e883c59a02504794e2846c7f955976*",".{0,1000}1f2cf255b1a6d9fafad11a2d27bc9471f1e883c59a02504794e2846c7f955976.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*1f615397bacd86a29514e0cc9981af1e76ba261c6634367508a7fd88bc088724*",".{0,1000}1f615397bacd86a29514e0cc9981af1e76ba261c6634367508a7fd88bc088724.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1f88f58c10b8f936cf8058e5effdef6a88ece05393f3c3df2a1247c3d6e651c0*",".{0,1000}1f88f58c10b8f936cf8058e5effdef6a88ece05393f3c3df2a1247c3d6e651c0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*1fd8e5fb9a446742894cec59f3007244ed3ea77b2f7401b6fc42333dc0a0ed51*",".{0,1000}1fd8e5fb9a446742894cec59f3007244ed3ea77b2f7401b6fc42333dc0a0ed51.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*221696c07ae07e3e5892f0538003c1ff036a5a1a89e6a2260fe435695214e3b0*",".{0,1000}221696c07ae07e3e5892f0538003c1ff036a5a1a89e6a2260fe435695214e3b0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*222472878481b038dba079d39e38666a6d49da0fce417645e9439f6385ffaba4*",".{0,1000}222472878481b038dba079d39e38666a6d49da0fce417645e9439f6385ffaba4.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2266628a8f1495e4ec904646ee77797367b359aaa3b3a1dd49449031bb5c7878*",".{0,1000}2266628a8f1495e4ec904646ee77797367b359aaa3b3a1dd49449031bb5c7878.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*244b58636bb8104b7b48fbb09402827ad91fd9424a1cb9dc15f8ca353718906d*",".{0,1000}244b58636bb8104b7b48fbb09402827ad91fd9424a1cb9dc15f8ca353718906d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2523d17e9fc1b815001f2e7ea951dd3454a78bab0b12cea6a82294b9d93cd95c*",".{0,1000}2523d17e9fc1b815001f2e7ea951dd3454a78bab0b12cea6a82294b9d93cd95c.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*2677ada64618dc9d5ac8f15ee9b377009c34376e72c3f460ada6db202821fbef*",".{0,1000}2677ada64618dc9d5ac8f15ee9b377009c34376e72c3f460ada6db202821fbef.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2699a142ddf7b9f8c30c65c37f4511f6dfb7a8114eab3d4ef026f04a3944fac1*",".{0,1000}2699a142ddf7b9f8c30c65c37f4511f6dfb7a8114eab3d4ef026f04a3944fac1.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2c775985d8d4e0262216794d6924aea06a6f9ce9888c6918347e3df3886e8579*",".{0,1000}2c775985d8d4e0262216794d6924aea06a6f9ce9888c6918347e3df3886e8579.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2ca71789c452d549809f184185b08febc560b5dc81030586a3920a95ea7a3d12*",".{0,1000}2ca71789c452d549809f184185b08febc560b5dc81030586a3920a95ea7a3d12.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*2ce1530925d694ce72da0deda5dc3f7f8ee6b5fe2b3b3ade80973e5b72c35e96*",".{0,1000}2ce1530925d694ce72da0deda5dc3f7f8ee6b5fe2b3b3ade80973e5b72c35e96.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2e441805f8ad1cd674a7d024936547d4268d9b8be63a7b08445ad6e394974f44*",".{0,1000}2e441805f8ad1cd674a7d024936547d4268d9b8be63a7b08445ad6e394974f44.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2e8d4bdf96c2294bb242e69f02fb44afcc5b710bb99d45047ee39d8d22f3f025*",".{0,1000}2e8d4bdf96c2294bb242e69f02fb44afcc5b710bb99d45047ee39d8d22f3f025.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2ec4ee6330d9e05cf8be0e465298e4da33f47e6ab5f93581998dc7ed2837bffd*",".{0,1000}2ec4ee6330d9e05cf8be0e465298e4da33f47e6ab5f93581998dc7ed2837bffd.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2ef8a13faa44755fab1ac6fb3665cc78f7e7b451*",".{0,1000}2ef8a13faa44755fab1ac6fb3665cc78f7e7b451.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*2f1f3b1b11933cc4f1396967bc588143aaa84313f08cf5aa1c4d009509d4d20d*",".{0,1000}2f1f3b1b11933cc4f1396967bc588143aaa84313f08cf5aa1c4d009509d4d20d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2fc0ed12ef82482e5f7afc1fc61e25f43139421f3a999d366ac1a403b33ece3c*",".{0,1000}2fc0ed12ef82482e5f7afc1fc61e25f43139421f3a999d366ac1a403b33ece3c.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*2ff4610933ac3310b66beca9b0f12bb88aa346c5ab8f1cfd4fd03219efbeacc9*",".{0,1000}2ff4610933ac3310b66beca9b0f12bb88aa346c5ab8f1cfd4fd03219efbeacc9.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3071cf9b377f62becd8f5ede7a3370eb94499fe28e87a6f6a4be6f6df3c0ac12*",".{0,1000}3071cf9b377f62becd8f5ede7a3370eb94499fe28e87a6f6a4be6f6df3c0ac12.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3212ec3f0ece0d3d4df29f816f2928ca98398c57f110f3e18dbbb656ff56f073*",".{0,1000}3212ec3f0ece0d3d4df29f816f2928ca98398c57f110f3e18dbbb656ff56f073.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*321f8b3fa818470657f9bf25d73016bf13ca8833c32f3c2fd98e54f4ef5d00d2*",".{0,1000}321f8b3fa818470657f9bf25d73016bf13ca8833c32f3c2fd98e54f4ef5d00d2.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3241d780f32a6a89d3b3f30d85f21f33f9d4d91227d129b2fd81d75baa870337*",".{0,1000}3241d780f32a6a89d3b3f30d85f21f33f9d4d91227d129b2fd81d75baa870337.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","#filehash","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*3277b33dfc78aeaf0a039394592d87ecbdd8a1964a0cca388df58a5684f796c1*",".{0,1000}3277b33dfc78aeaf0a039394592d87ecbdd8a1964a0cca388df58a5684f796c1.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*32A2A734-7429-47E6-A362-E344A19C0D85*",".{0,1000}32A2A734\-7429\-47E6\-A362\-E344A19C0D85.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","#GUIDproject","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*334ec9e7d937c42e8ef12f9d4ec90862ecc5410c06442393a38390b34886aa59*",".{0,1000}334ec9e7d937c42e8ef12f9d4ec90862ecc5410c06442393a38390b34886aa59.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*33afcd4459db6fdcd977d24963acff551615be452d0fe8e1df8f862f058d6c48*",".{0,1000}33afcd4459db6fdcd977d24963acff551615be452d0fe8e1df8f862f058d6c48.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3538bb3c8d8d8640f15a31a53e7d688fec5043a5d9ee8ac917da83e699e503e2*",".{0,1000}3538bb3c8d8d8640f15a31a53e7d688fec5043a5d9ee8ac917da83e699e503e2.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3660fe9f10b94d38fecaea009e6625850a46b1d47bb7788fc47f286c1008e2ec*",".{0,1000}3660fe9f10b94d38fecaea009e6625850a46b1d47bb7788fc47f286c1008e2ec.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*36a7532a957652a55dbf0b196905652a1f0b8c4019b7ca4e749fa81e5f2c149b*",".{0,1000}36a7532a957652a55dbf0b196905652a1f0b8c4019b7ca4e749fa81e5f2c149b.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","#filehash","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*376c1371b87dd3ea20ad65ada4ef47f811218382422843a4ecb3fd590fc62c8a*",".{0,1000}376c1371b87dd3ea20ad65ada4ef47f811218382422843a4ecb3fd590fc62c8a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3791fe80848940a320ef55ec49c9a23fffcb1b97977d0a6140df61efc6533829*",".{0,1000}3791fe80848940a320ef55ec49c9a23fffcb1b97977d0a6140df61efc6533829.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","#filehash","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*37B9B43761672219E98BFA826E7AF17E799592BC57ACBC4AAC38DAF5EFAAF653*",".{0,1000}37B9B43761672219E98BFA826E7AF17E799592BC57ACBC4AAC38DAF5EFAAF653.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*3887f7179aa36da3d9fc527a714d6f4be500dd25beede1e161e9f019beaf7636*",".{0,1000}3887f7179aa36da3d9fc527a714d6f4be500dd25beede1e161e9f019beaf7636.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*388d03b5f42d14e0d68541fa74da9abc891e3fb7f7f6daae98d8e0e963c255b4*",".{0,1000}388d03b5f42d14e0d68541fa74da9abc891e3fb7f7f6daae98d8e0e963c255b4.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*39e4be4d1d4bb0a5c9bdffd4128901444e603f9c77f5525c87a381131d82f323*",".{0,1000}39e4be4d1d4bb0a5c9bdffd4128901444e603f9c77f5525c87a381131d82f323.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3a137179e0095bf147e50fea7bec3ffb989f0b53d0bbe5bdab21dba5c173b414*",".{0,1000}3a137179e0095bf147e50fea7bec3ffb989f0b53d0bbe5bdab21dba5c173b414.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3b2cec2cc3a2e3185fc1797590dc58421cf4382e86d83e8658990bb3979d7209*",".{0,1000}3b2cec2cc3a2e3185fc1797590dc58421cf4382e86d83e8658990bb3979d7209.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*3ba1b87c659e4c9ca752c50c7e9414ed46f982ce88d668e7d918a95af13315c9*",".{0,1000}3ba1b87c659e4c9ca752c50c7e9414ed46f982ce88d668e7d918a95af13315c9.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3bad0a20a77b7839ab4e236d31b4de469a0e0e58ce2195d2d7b2df8decec7ce3*",".{0,1000}3bad0a20a77b7839ab4e236d31b4de469a0e0e58ce2195d2d7b2df8decec7ce3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3DDF7FBB35EC90BCF15E723F1445EEB71E71C9757243EFEC1CEB4E74A10A1D9F*",".{0,1000}3DDF7FBB35EC90BCF15E723F1445EEB71E71C9757243EFEC1CEB4E74A10A1D9F.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*3e754f15b17e2c21e6579a263990aecdf7652c7994b117d928782cd31cca590a*",".{0,1000}3e754f15b17e2c21e6579a263990aecdf7652c7994b117d928782cd31cca590a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3e81cd5540da875704d3109537203c7381b80b854851fe43ff2c806778b061b0*",".{0,1000}3e81cd5540da875704d3109537203c7381b80b854851fe43ff2c806778b061b0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3f3ab39136e22d9cf714ab609d182d079a5cf2c6acf36d26ec9d88b64b209509*",".{0,1000}3f3ab39136e22d9cf714ab609d182d079a5cf2c6acf36d26ec9d88b64b209509.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3f47dae30e9b18dcfd50eef1d188f83171072136257758ea39997818f38d49e8*",".{0,1000}3f47dae30e9b18dcfd50eef1d188f83171072136257758ea39997818f38d49e8.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*3fb343762a0cdfe57ac0e85f3b5cb93dc5579c9d820d4a268ca81e809bea089c*",".{0,1000}3fb343762a0cdfe57ac0e85f3b5cb93dc5579c9d820d4a268ca81e809bea089c.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*3ff86dceb685d7dc4b7c14553cc557a3a9eac36e0f0565d8a4c0576f6eee242c*",".{0,1000}3ff86dceb685d7dc4b7c14553cc557a3a9eac36e0f0565d8a4c0576f6eee242c.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*40c8f1e14c24fe384c4ed1845716ea52b391c9a867838f0a817e60d9eff6f941*",".{0,1000}40c8f1e14c24fe384c4ed1845716ea52b391c9a867838f0a817e60d9eff6f941.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*43861355ea40db311824a51d5a4c6dc773ebfc0c5862a252a4692847f184594c*",".{0,1000}43861355ea40db311824a51d5a4c6dc773ebfc0c5862a252a4692847f184594c.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*43e4ddd1285dfb190c49ab4c6d488369b5ae72234a5d87afd93bc6fc2d675076*",".{0,1000}43e4ddd1285dfb190c49ab4c6d488369b5ae72234a5d87afd93bc6fc2d675076.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4445ad2ca90c814faa03bcbd25681af7063bb0d3f6ae4930e433e9d4b6ae84e3*",".{0,1000}4445ad2ca90c814faa03bcbd25681af7063bb0d3f6ae4930e433e9d4b6ae84e3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4511497ad6ecfef8d3a9fcf7585eb454edf22ea0dae6f77be2c81e7a6539dcd7*",".{0,1000}4511497ad6ecfef8d3a9fcf7585eb454edf22ea0dae6f77be2c81e7a6539dcd7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4524035a526a4871f7165635991d84d188b944dcd74971d3db44335d1e7565fd*",".{0,1000}4524035a526a4871f7165635991d84d188b944dcd74971d3db44335d1e7565fd.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*452ef95ff3475ce13c5533a13d6f3e084ec940091c710a75a335d2cdf47ce846*",".{0,1000}452ef95ff3475ce13c5533a13d6f3e084ec940091c710a75a335d2cdf47ce846.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*460acbb38b0bdb3d227de65010b1a323f448ec196860ce4979c0b8314763eb56*",".{0,1000}460acbb38b0bdb3d227de65010b1a323f448ec196860ce4979c0b8314763eb56.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*4625292d15399581f185b11ab34ba654c5b10f25bfe917132f7e1dcd19dddc94*",".{0,1000}4625292d15399581f185b11ab34ba654c5b10f25bfe917132f7e1dcd19dddc94.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4655c54ddae45ebc1b2b32a9568af775791964cf9ed6e2198a5d11ce466c23fd*",".{0,1000}4655c54ddae45ebc1b2b32a9568af775791964cf9ed6e2198a5d11ce466c23fd.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*47076023e33117b13ed9e9ef7be415067600c180b460a1c73823560de005eb0d*",".{0,1000}47076023e33117b13ed9e9ef7be415067600c180b460a1c73823560de005eb0d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4773c4275d0b56d5b80953003dc9956a6a7aa8c4a016480986fb409aef9b161c*",".{0,1000}4773c4275d0b56d5b80953003dc9956a6a7aa8c4a016480986fb409aef9b161c.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4a45903123dc54041be3142c9736129aad4a5a440d1f0388e0b8875808cc3d56*",".{0,1000}4a45903123dc54041be3142c9736129aad4a5a440d1f0388e0b8875808cc3d56.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4a5635751d0b33ed9473bee0c056269d17d33aa3c4a5019d9bb5947a61cb081a*",".{0,1000}4a5635751d0b33ed9473bee0c056269d17d33aa3c4a5019d9bb5947a61cb081a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4bb2a508148f1895c0371293b6430f18a4083e753e0901dc6257b9d16114f28e*",".{0,1000}4bb2a508148f1895c0371293b6430f18a4083e753e0901dc6257b9d16114f28e.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*4bf552065bb179e2da10c1e65463ccc68f451faae21468ebc91ec83308ebbe36*",".{0,1000}4bf552065bb179e2da10c1e65463ccc68f451faae21468ebc91ec83308ebbe36.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4c9aad477ebdd6bbc57a746b43db4fa1398f4f998e8ebf6e26e10ec5dccb9e68*",".{0,1000}4c9aad477ebdd6bbc57a746b43db4fa1398f4f998e8ebf6e26e10ec5dccb9e68.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*4d95694b73357e0e304b68cdbb00bd65da3ffcaa7e2148141dbc4e29357b5a52*",".{0,1000}4d95694b73357e0e304b68cdbb00bd65da3ffcaa7e2148141dbc4e29357b5a52.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4daa7e8e607567451a1db6eb4c297c60a028263756b460c75bc5a31c39bc968b*",".{0,1000}4daa7e8e607567451a1db6eb4c297c60a028263756b460c75bc5a31c39bc968b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4de5606b62d1fe9200c6a473f4d04ebe7a492172e36e8387ec9647c3d399cfd9*",".{0,1000}4de5606b62d1fe9200c6a473f4d04ebe7a492172e36e8387ec9647c3d399cfd9.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4e021eda86591c657ec781b77472518ecbf51b4f2a1b63e2ab53ac7289e59428*",".{0,1000}4e021eda86591c657ec781b77472518ecbf51b4f2a1b63e2ab53ac7289e59428.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4e5d34573206efd1a545796a8c2c233a80fe5301c11eee3024e978b0977a4521*",".{0,1000}4e5d34573206efd1a545796a8c2c233a80fe5301c11eee3024e978b0977a4521.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4eb752de605ffcacb6aaf1e613bef1596b6a4583811d1b2fc6b0948df4febddd*",".{0,1000}4eb752de605ffcacb6aaf1e613bef1596b6a4583811d1b2fc6b0948df4febddd.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4f21a1d0e7caa97018e4d0b8c7e63fbc54d081976dfda9409f57a3ead24074a7*",".{0,1000}4f21a1d0e7caa97018e4d0b8c7e63fbc54d081976dfda9409f57a3ead24074a7.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","#filehash","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*4f4a7ad2eedc23ab3b6127a704fe66efbbda6bc654b98741aa2aadb8293d5864*",".{0,1000}4f4a7ad2eedc23ab3b6127a704fe66efbbda6bc654b98741aa2aadb8293d5864.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4F748D41-5BE1-4626-A0AB-9EA15CDC2074*",".{0,1000}4F748D41\-5BE1\-4626\-A0AB\-9EA15CDC2074.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#GUIDproject","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*4fd9e503868b34bf6c0de86423afd252160aec8f3218458f2a4d3d774b84a99d*",".{0,1000}4fd9e503868b34bf6c0de86423afd252160aec8f3218458f2a4d3d774b84a99d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*52e9a87377d0237b7c1a1c8247898ec1a41bfa2a52af411694ff62b70b64917b*",".{0,1000}52e9a87377d0237b7c1a1c8247898ec1a41bfa2a52af411694ff62b70b64917b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*532f05083cc5b4ef33e473ca5d956da9d9e372673bd3803d20193b879a083487*",".{0,1000}532f05083cc5b4ef33e473ca5d956da9d9e372673bd3803d20193b879a083487.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*54d84eaf8b6d8d6d0b865c39b39a8253c079d571e066d02b50c5d0dd50d1be74*",".{0,1000}54d84eaf8b6d8d6d0b865c39b39a8253c079d571e066d02b50c5d0dd50d1be74.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*54ef26ef5847752d4acc732de7e294cb02766d89fc5eb30ead4de42cea331d79*",".{0,1000}54ef26ef5847752d4acc732de7e294cb02766d89fc5eb30ead4de42cea331d79.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*568be7e64dc6dd20516910fe1cd2db611fee2b3051b2ff81ca1ef092bf3bbd91*",".{0,1000}568be7e64dc6dd20516910fe1cd2db611fee2b3051b2ff81ca1ef092bf3bbd91.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*56f939d7b5513df64ad63f7bf2da6cafa98778872aecfbce5f55161648ca4231*",".{0,1000}56f939d7b5513df64ad63f7bf2da6cafa98778872aecfbce5f55161648ca4231.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*59d935b141966f1706eaf690c8937ef1f4a75303b2852f3fcbd6b77d1287d744*",".{0,1000}59d935b141966f1706eaf690c8937ef1f4a75303b2852f3fcbd6b77d1287d744.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*5a65d7c3fda43337fd1422f92403901a460c12a37f89da6cb70833802a2f1c9b*",".{0,1000}5a65d7c3fda43337fd1422f92403901a460c12a37f89da6cb70833802a2f1c9b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*5b0b491a401d5031b75aaa1bfe8ab32d55befb03d7cb627de72409fce0b5a103*",".{0,1000}5b0b491a401d5031b75aaa1bfe8ab32d55befb03d7cb627de72409fce0b5a103.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*5C3AD9AC-C62C-4AA8-BAE2-9AF920A652E3*",".{0,1000}5C3AD9AC\-C62C\-4AA8\-BAE2\-9AF920A652E3.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","#GUIDproject","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*5dc1924bef12ac4d6b3a428b16f92545e54a4f2a53ccf416f327cab35eed20b5*",".{0,1000}5dc1924bef12ac4d6b3a428b16f92545e54a4f2a53ccf416f327cab35eed20b5.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*5e7401fba3d86958c0efddc44addbba7dd34e629ba47501445f1bb9db88eb52a*",".{0,1000}5e7401fba3d86958c0efddc44addbba7dd34e629ba47501445f1bb9db88eb52a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*6003ae86c0abcc19ae6c799724e679762ed37934ab6b5c3064f65988df64a242*",".{0,1000}6003ae86c0abcc19ae6c799724e679762ed37934ab6b5c3064f65988df64a242.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","#filehash","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*625ae9460120.ngrok.io*",".{0,1000}625ae9460120\.ngrok\.io.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*635c9083e14310cee41e7f5caaa91249130280aca25911346a82e5edbbbeebf9*",".{0,1000}635c9083e14310cee41e7f5caaa91249130280aca25911346a82e5edbbbeebf9.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*639d2a5d5cab0b60d2f2d22c835f997db1b16cf5ac4a8d88f3c91d43247d359d*",".{0,1000}639d2a5d5cab0b60d2f2d22c835f997db1b16cf5ac4a8d88f3c91d43247d359d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*65f081caa613ba53342c9c3dd7188f22552b83c9e8ac73f740321f99f6a9fe5b*",".{0,1000}65f081caa613ba53342c9c3dd7188f22552b83c9e8ac73f740321f99f6a9fe5b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309*",".{0,1000}68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*69ad04521e133db1e34347ec9a6ecb8ea3f90272c77ce2471c3145ac33fad13b*",".{0,1000}69ad04521e133db1e34347ec9a6ecb8ea3f90272c77ce2471c3145ac33fad13b.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","#filehash","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*69ea24257c033294c33d7bb036d7ea550a75d00c2313c6d4ef25126b67d7a574*",".{0,1000}69ea24257c033294c33d7bb036d7ea550a75d00c2313c6d4ef25126b67d7a574.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*69fd60793b4333e2c0fd80f36d293b6eea6cd3b8f3761b65b7074ef1d812fab9*",".{0,1000}69fd60793b4333e2c0fd80f36d293b6eea6cd3b8f3761b65b7074ef1d812fab9.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*6b5f393778459329dbdc69151a3492bb3f18b798bc6e9a7707219923b2a0aab9*",".{0,1000}6b5f393778459329dbdc69151a3492bb3f18b798bc6e9a7707219923b2a0aab9.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*6badff5495258b349559b9d2154ffcc7a435828dd57c4caf1c79f5d0ff9eb675*",".{0,1000}6badff5495258b349559b9d2154ffcc7a435828dd57c4caf1c79f5d0ff9eb675.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*6d331a0cf4808cc0a5141960acfe009d99e5b6e33b477216c9e888d55a04885e*",".{0,1000}6d331a0cf4808cc0a5141960acfe009d99e5b6e33b477216c9e888d55a04885e.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*6de3528cac2c68c0f14a98474db820bb8291b49ab63727e52d58d29288af3fa7*",".{0,1000}6de3528cac2c68c0f14a98474db820bb8291b49ab63727e52d58d29288af3fa7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*6e12d0f2f68b89133032436717f20a60bc8b9b0e116f2985e658dfb0f1e46066*",".{0,1000}6e12d0f2f68b89133032436717f20a60bc8b9b0e116f2985e658dfb0f1e46066.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*6ebf021ec1ecf18a97b59fcf9c045aa245120b84a84a5319dbbc5ff4c34f42ee*",".{0,1000}6ebf021ec1ecf18a97b59fcf9c045aa245120b84a84a5319dbbc5ff4c34f42ee.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*70f1ed3ea1ba5d2fe5430735089f03cbce1b85a4c719ad2adc7d1049345f2b6c*",".{0,1000}70f1ed3ea1ba5d2fe5430735089f03cbce1b85a4c719ad2adc7d1049345f2b6c.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*70f7f49337d31968d4a2b7eb27200bced44eade5ba5c75547bd1f9a51660f2d5*",".{0,1000}70f7f49337d31968d4a2b7eb27200bced44eade5ba5c75547bd1f9a51660f2d5.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*710c8601b26a63482c9d8044bfb12d8dec9297aaa593942cb68185276dd304b6*",".{0,1000}710c8601b26a63482c9d8044bfb12d8dec9297aaa593942cb68185276dd304b6.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*72d4be0337fe92dda02f3828e2f1f7df290a1c079e81ef3873d9c0502bbe90a3*",".{0,1000}72d4be0337fe92dda02f3828e2f1f7df290a1c079e81ef3873d9c0502bbe90a3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*74d130cad8acef03e4faa3b5befcb1351db038fa47421d6a5d3010f583ab0e47*",".{0,1000}74d130cad8acef03e4faa3b5befcb1351db038fa47421d6a5d3010f583ab0e47.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*763e2f8597ef969c08a17932f0d4e10424b478314ceddbf72ba13a5d41aa8df0*",".{0,1000}763e2f8597ef969c08a17932f0d4e10424b478314ceddbf72ba13a5d41aa8df0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*770ca5efa95e4c0a44f8f1653c41d79c9fe55d0e9a228eb2d374bdd8a11a63f7*",".{0,1000}770ca5efa95e4c0a44f8f1653c41d79c9fe55d0e9a228eb2d374bdd8a11a63f7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*77432fd21f975da9215b15efc8e0080345732102f7d57a5d9d57f61faa4dfa20*",".{0,1000}77432fd21f975da9215b15efc8e0080345732102f7d57a5d9d57f61faa4dfa20.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*7777E837-E7A3-481B-8BD2-4C76F639ECFC*",".{0,1000}7777E837\-E7A3\-481B\-8BD2\-4C76F639ECFC.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","#GUIDproject","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*7a64765efe8fe0d9f6a346e5f38aae30a3534f931e539890114aea698d8960cb*",".{0,1000}7a64765efe8fe0d9f6a346e5f38aae30a3534f931e539890114aea698d8960cb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*7b5de4f0a090f29dd3d63a3d773b792cb059e2b39497ff4d633fcabb2afbc297*",".{0,1000}7b5de4f0a090f29dd3d63a3d773b792cb059e2b39497ff4d633fcabb2afbc297.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*7b89ba929cc86c0b945cef5168476ba82ac80d19c9c2111d816643eb453cb14d*",".{0,1000}7b89ba929cc86c0b945cef5168476ba82ac80d19c9c2111d816643eb453cb14d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*7c26189a98e1b82293fa72a8a88725ecce3d38622480e5809b8bec9fca407ab1*",".{0,1000}7c26189a98e1b82293fa72a8a88725ecce3d38622480e5809b8bec9fca407ab1.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*7d49e7215481d044c66c2af30c063b4253e2086be6b20f6c99142ad3b6fb4fbe*",".{0,1000}7d49e7215481d044c66c2af30c063b4253e2086be6b20f6c99142ad3b6fb4fbe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*7d602aa3b76b0aae9dd6771e6451d3aa23b89f46ff115b0096b9074d110e2877*",".{0,1000}7d602aa3b76b0aae9dd6771e6451d3aa23b89f46ff115b0096b9074d110e2877.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*7d739b6a0667be4e84dff7ad01ae6db2369aac0bb8685d1eafb74a239cf3dde4*",".{0,1000}7d739b6a0667be4e84dff7ad01ae6db2369aac0bb8685d1eafb74a239cf3dde4.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*7f08d1c537cc683674c8b85e02ba5ae0513a779fc416c687f82a1b0eba4010d8*",".{0,1000}7f08d1c537cc683674c8b85e02ba5ae0513a779fc416c687f82a1b0eba4010d8.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*7f68729cb251f5aa9ecba08e57f13c8a258ea3cb3c45e7f99881ca496a639d7e*",".{0,1000}7f68729cb251f5aa9ecba08e57f13c8a258ea3cb3c45e7f99881ca496a639d7e.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*7fab6b56cc09d922c7160833d912a2a23ac61ae9d6dc1156d8228bc2c03f5059*",".{0,1000}7fab6b56cc09d922c7160833d912a2a23ac61ae9d6dc1156d8228bc2c03f5059.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*80cd76926ec4cf711da761f81d469824ebfc21388b3e062fee509ea087f23a5a*",".{0,1000}80cd76926ec4cf711da761f81d469824ebfc21388b3e062fee509ea087f23a5a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*811febc6169517fbd42233cdc003fcaf660f1ee969fcea98261647274ae27f2a*",".{0,1000}811febc6169517fbd42233cdc003fcaf660f1ee969fcea98261647274ae27f2a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*81336615ec3491b5ef7770fefaaa4c955dc1bc123d79bb90b24a86989c95aa86*",".{0,1000}81336615ec3491b5ef7770fefaaa4c955dc1bc123d79bb90b24a86989c95aa86.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*82d32160a4bc234ba3e1d34412e65ee7a74c904df4156a896f71c422a103abd6*",".{0,1000}82d32160a4bc234ba3e1d34412e65ee7a74c904df4156a896f71c422a103abd6.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8365dc72d291194a2b3bd59e36473db7404a219fe999c50dad3d793c3a3178e4*",".{0,1000}8365dc72d291194a2b3bd59e36473db7404a219fe999c50dad3d793c3a3178e4.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*84bd394d27a36a89e86a265dd05d14d4747f16ec916044fec21ec113bf96a1c4*",".{0,1000}84bd394d27a36a89e86a265dd05d14d4747f16ec916044fec21ec113bf96a1c4.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*85f0b24d9e734c48dfe285aece6b7decb23eaa976590245adf67e43b1bc222d1*",".{0,1000}85f0b24d9e734c48dfe285aece6b7decb23eaa976590245adf67e43b1bc222d1.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*86f533145306e79ccdbe21d0b46326ae9fab9507f3a1740d0ffc8a088ce18d02*",".{0,1000}86f533145306e79ccdbe21d0b46326ae9fab9507f3a1740d0ffc8a088ce18d02.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*87759dcbffdc166d166545937d55787701b69197a7138ac01850f661f2dceed4*",".{0,1000}87759dcbffdc166d166545937d55787701b69197a7138ac01850f661f2dceed4.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*881f6c9e3c1e70dd076b850c146352b733957e1ef90a76c46595631f2cd5ff7c*",".{0,1000}881f6c9e3c1e70dd076b850c146352b733957e1ef90a76c46595631f2cd5ff7c.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8a51f608a0c289334d341590a8b59fce757f07fd112aaa5459fc9c51891b5e60*",".{0,1000}8a51f608a0c289334d341590a8b59fce757f07fd112aaa5459fc9c51891b5e60.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8a589ad4b3ec87077fb149d95a7c53d4a9422c2270b8d83a17c2ae0e2bcc816f*",".{0,1000}8a589ad4b3ec87077fb149d95a7c53d4a9422c2270b8d83a17c2ae0e2bcc816f.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8a9035a8ebb7500049aacb7291c559d29a2db2024cfdac39fbdd6ff277dc2764*",".{0,1000}8a9035a8ebb7500049aacb7291c559d29a2db2024cfdac39fbdd6ff277dc2764.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8c1b2481e4dfe27c73d6446784fae2b9d2c7d27c11e0a19b081e877a38d08c94*",".{0,1000}8c1b2481e4dfe27c73d6446784fae2b9d2c7d27c11e0a19b081e877a38d08c94.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8c38c4c17d8d8382d9fe1f98db556bca3cfeb3fef0359d9d7c01ab73477b4a48*",".{0,1000}8c38c4c17d8d8382d9fe1f98db556bca3cfeb3fef0359d9d7c01ab73477b4a48.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8cec1c5a5e6e7e7a7b2d2991e12587228ed2aa9428b1af003ff68dd6bd6994a4*",".{0,1000}8cec1c5a5e6e7e7a7b2d2991e12587228ed2aa9428b1af003ff68dd6bd6994a4.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*8d16dbb3c90052e4a2644008d40b65813912d7b117ab6f8c65e886f2881361c2*",".{0,1000}8d16dbb3c90052e4a2644008d40b65813912d7b117ab6f8c65e886f2881361c2.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8ddb38319fb34f580a0f3732fcf3f40b13c2b562fd676b189481e1cc0e361381*",".{0,1000}8ddb38319fb34f580a0f3732fcf3f40b13c2b562fd676b189481e1cc0e361381.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*8f798e081ea1cb1e106552ab9a7241994d3c05dd18970f3e1ad8329d3738bd7e*",".{0,1000}8f798e081ea1cb1e106552ab9a7241994d3c05dd18970f3e1ad8329d3738bd7e.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9043fcb49a3326bc9887c4a8cff27560c53edf4792fc94024f756a5791da38a8*",".{0,1000}9043fcb49a3326bc9887c4a8cff27560c53edf4792fc94024f756a5791da38a8.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9147ff5871fe6cfb56f5ad85e69570ef5d904a20b4cf8135a59ea687e9efe7b0*",".{0,1000}9147ff5871fe6cfb56f5ad85e69570ef5d904a20b4cf8135a59ea687e9efe7b0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*917759e1b76b72229b5dc928b07af4a4d1f99b41111da42580aeb28ef2aefd3e*",".{0,1000}917759e1b76b72229b5dc928b07af4a4d1f99b41111da42580aeb28ef2aefd3e.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*91aceb4ee71ac847521007ac796e718ad5bb6577c28b5c992e810e2f4e402046*",".{0,1000}91aceb4ee71ac847521007ac796e718ad5bb6577c28b5c992e810e2f4e402046.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*91e7b6bf8831219775f176389103295d7065a7e6eb74c68c1093416be508ba14*",".{0,1000}91e7b6bf8831219775f176389103295d7065a7e6eb74c68c1093416be508ba14.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*92dfe587c369ed8afad29bcb4ae5ed9a313cb563b2e52ff0b0494f15dcd5fd33*",".{0,1000}92dfe587c369ed8afad29bcb4ae5ed9a313cb563b2e52ff0b0494f15dcd5fd33.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*92f34dca0bd5715dbfffcdceeb89ffab9cd8115c2faf07cbd1e34071795cdb44*",".{0,1000}92f34dca0bd5715dbfffcdceeb89ffab9cd8115c2faf07cbd1e34071795cdb44.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*92f384f789dae517d1da7493322db430f5a7d4a6b7d7b74ca3b075bfac881b15*",".{0,1000}92f384f789dae517d1da7493322db430f5a7d4a6b7d7b74ca3b075bfac881b15.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*92f9a5bbfd116c4e20227af72b651b95a4190b346cb391762d0d50f5245d3355*",".{0,1000}92f9a5bbfd116c4e20227af72b651b95a4190b346cb391762d0d50f5245d3355.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*94253480a0f1e3be221902d60f94463420057f8d84f9136abd6b7448332a1fe6*",".{0,1000}94253480a0f1e3be221902d60f94463420057f8d84f9136abd6b7448332a1fe6.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9456bf9d11fd8cee55619fc0a2ffe3443f9bfea51589af5c3b1282dfa50eb2a7*",".{0,1000}9456bf9d11fd8cee55619fc0a2ffe3443f9bfea51589af5c3b1282dfa50eb2a7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*947895eee1492a0f6da5c69fe68361b97359f52f99ac72f7947a456618f0ec7f*",".{0,1000}947895eee1492a0f6da5c69fe68361b97359f52f99ac72f7947a456618f0ec7f.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9506632b80989310f2d2cca6a35e036d21213776cfff6623c28f1c5d3b8588c7*",".{0,1000}9506632b80989310f2d2cca6a35e036d21213776cfff6623c28f1c5d3b8588c7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9507e23a60968916342e626ca86fdde847cb30dafbe12a3f50f8854efef0f62e*",".{0,1000}9507e23a60968916342e626ca86fdde847cb30dafbe12a3f50f8854efef0f62e.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*950ecb779365ffc85a6eba98a8d8dd5dfad765692385a2f59bc93ddbf13a489a*",".{0,1000}950ecb779365ffc85a6eba98a8d8dd5dfad765692385a2f59bc93ddbf13a489a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*96fb297f3cba18a95a7228a4853a0641d193859999a5488b0cbae6efe708e89c*",".{0,1000}96fb297f3cba18a95a7228a4853a0641d193859999a5488b0cbae6efe708e89c.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*971a9d100a6bed85f54fa61064075260f64396b2977e716cdd5537f5ab3c5e92*",".{0,1000}971a9d100a6bed85f54fa61064075260f64396b2977e716cdd5537f5ab3c5e92.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9887df54ec10a12b986c325675b360e2c43924618104c7914928520ede514fa0*",".{0,1000}9887df54ec10a12b986c325675b360e2c43924618104c7914928520ede514fa0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9b08ea44ec7fa2954c60c82ad8c4d54cdf84f3ea336639445b2b8b1d978551e0*",".{0,1000}9b08ea44ec7fa2954c60c82ad8c4d54cdf84f3ea336639445b2b8b1d978551e0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9c3262961652f77177675bb812a2e5037223505b780999dc4a57c656afe9e1e6*",".{0,1000}9c3262961652f77177675bb812a2e5037223505b780999dc4a57c656afe9e1e6.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9CD1DDB78ED05282353B20CDFE8FA0A4FB6C1ECE*",".{0,1000}9CD1DDB78ED05282353B20CDFE8FA0A4FB6C1ECE.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage - compromised certificate - https://anydesk.com/en/changelog/windows","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","#certificate","compromised certificate","8","8","N/A","N/A","N/A","N/A"
"*9d0c7f0c88518e5d682763f7697796846ba0c4156371bfc8df612f38b33b77e3*",".{0,1000}9d0c7f0c88518e5d682763f7697796846ba0c4156371bfc8df612f38b33b77e3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9d2ce0345f4ee5798a49a8a13e33c7502a2ac655*",".{0,1000}9d2ce0345f4ee5798a49a8a13e33c7502a2ac655.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*9D7620A4CEBA92370E8828B3CB1007AEFF63AB36A2CBE5F044FDDE14ABAB1EBF*",".{0,1000}9D7620A4CEBA92370E8828B3CB1007AEFF63AB36A2CBE5F044FDDE14ABAB1EBF.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage - compromised certificate - https://anydesk.com/en/changelog/windows","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","#certificate","compromised certificate","8","8","N/A","N/A","N/A","N/A"
"*9dffd0600ac3634e75d99c867d2ca3791cd3a302513c42b4465c6300977d824c*",".{0,1000}9dffd0600ac3634e75d99c867d2ca3791cd3a302513c42b4465c6300977d824c.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9e4a589aa9658c35abbcca54036c9cc0070d05f0708b8df2d8e9030bbb9f541a*",".{0,1000}9e4a589aa9658c35abbcca54036c9cc0070d05f0708b8df2d8e9030bbb9f541a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9F5CF56A-DDB2-4F40-AB99-2A1DC47588E1*",".{0,1000}9F5CF56A\-DDB2\-4F40\-AB99\-2A1DC47588E1.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","#GUIDproject","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*9f6fbc95920e22acace881c5702a9fda81104d98ff5f37ed2c343898d371c8b3*",".{0,1000}9f6fbc95920e22acace881c5702a9fda81104d98ff5f37ed2c343898d371c8b3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*9fc6416952495e1c0a13f2b1af1bf774e6dc5a90fcf0a50c942bba56709cb921*",".{0,1000}9fc6416952495e1c0a13f2b1af1bf774e6dc5a90fcf0a50c942bba56709cb921.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a.aomeisoftware.com*",".{0,1000}a\.aomeisoftware\.com.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*a0503d04e1f71f6856503024b70552eeeb6954e4aac61040a008f3917b38a684*",".{0,1000}a0503d04e1f71f6856503024b70552eeeb6954e4aac61040a008f3917b38a684.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a0b1523b50b26c6ceb479513d2278d448d9e826cebbaf2af7decd3e01b5d7a59*",".{0,1000}a0b1523b50b26c6ceb479513d2278d448d9e826cebbaf2af7decd3e01b5d7a59.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a0c293a144cb66f4b07d8bd7d52a489b89c2ff30af9427c399e400bc3d374505*",".{0,1000}a0c293a144cb66f4b07d8bd7d52a489b89c2ff30af9427c399e400bc3d374505.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*a0ffaba8096c1c103f4cadbf7e373d838f5ebca0b1f4a1b4fc600d623c7d4640*",".{0,1000}a0ffaba8096c1c103f4cadbf7e373d838f5ebca0b1f4a1b4fc600d623c7d4640.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a12f1b3315057920742569bb98f5031bfd200c52c6a808b327e5048a4f4991a4*",".{0,1000}a12f1b3315057920742569bb98f5031bfd200c52c6a808b327e5048a4f4991a4.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a1d79ad7af2af9ffbcad20b0b5555f6a64d46eb19deada41d93e8becbd4866e3*",".{0,1000}a1d79ad7af2af9ffbcad20b0b5555f6a64d46eb19deada41d93e8becbd4866e3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a1-server-prod-even.action1.com*",".{0,1000}a1\-server\-prod\-even\.action1\.com.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*a220124d70563eb4e79926b0b7ff4bfab36fc29d58b21152455ae1c63bbd5a28*",".{0,1000}a220124d70563eb4e79926b0b7ff4bfab36fc29d58b21152455ae1c63bbd5a28.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a25a28812d135f5a5dbc0a5a697cce19d94acd80913472d3dcc61178f9479e40*",".{0,1000}a25a28812d135f5a5dbc0a5a697cce19d94acd80913472d3dcc61178f9479e40.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a2af16bc6414fd3ce32d31efb76128bc14408027e654eada6569ee99df350a35*",".{0,1000}a2af16bc6414fd3ce32d31efb76128bc14408027e654eada6569ee99df350a35.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a2fa034d006bdbc3ee2a15e55eb647f8097355c288a858da1e309fe8ac1cf0a3*",".{0,1000}a2fa034d006bdbc3ee2a15e55eb647f8097355c288a858da1e309fe8ac1cf0a3.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*a3e6acda8965a5770977ec13a0431d2c544d12bc3f0c898a7c76cdf81ae33a69*",".{0,1000}a3e6acda8965a5770977ec13a0431d2c544d12bc3f0c898a7c76cdf81ae33a69.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a41b226ee731ac6c200b17e4367a5f57515f826896aed0a37f0595f9fe68b979*",".{0,1000}a41b226ee731ac6c200b17e4367a5f57515f826896aed0a37f0595f9fe68b979.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a4e6692b22ae9d6e230116f6f530c9775ab4d38743c460dc099f948e92cf075d*",".{0,1000}a4e6692b22ae9d6e230116f6f530c9775ab4d38743c460dc099f948e92cf075d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a5077f2fed33c896f464b7e3122debb2cbf0e3a4a69b848313113f8ec06d1aae*",".{0,1000}a5077f2fed33c896f464b7e3122debb2cbf0e3a4a69b848313113f8ec06d1aae.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a644c87ef0ae3fda790a705dae60cb7c7d2c1153ea3def2fe6f56a822d2e4e9e*",".{0,1000}a644c87ef0ae3fda790a705dae60cb7c7d2c1153ea3def2fe6f56a822d2e4e9e.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*a706b0c389ebfbd01cbdf08359c81497eda81c315a7963960ed8968a2173c866*",".{0,1000}a706b0c389ebfbd01cbdf08359c81497eda81c315a7963960ed8968a2173c866.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a7446e282755e5340b33572986e83bffa2a984d04d6f465d0a30da9538f9cea4*",".{0,1000}a7446e282755e5340b33572986e83bffa2a984d04d6f465d0a30da9538f9cea4.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a8048a99c160781dd4b323d3751f9717663265416de4495fd9c7227bbee8a2f8*",".{0,1000}a8048a99c160781dd4b323d3751f9717663265416de4495fd9c7227bbee8a2f8.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a81e90b8c56431c28537a4232b76cd55cf44217eabc106d359840f10be32d465*",".{0,1000}a81e90b8c56431c28537a4232b76cd55cf44217eabc106d359840f10be32d465.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a8a9b5fd7a0cc44f6874c90b4170009a46a88adc92367fcafb2acd32958afc98*",".{0,1000}a8a9b5fd7a0cc44f6874c90b4170009a46a88adc92367fcafb2acd32958afc98.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a908c8a15c730ce061360bcbb351135484b0f6e0a1fd19847888818bdab73d86*",".{0,1000}a908c8a15c730ce061360bcbb351135484b0f6e0a1fd19847888818bdab73d86.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a930c85fbceaf955c9ae865893b20a7164b0f8020b0a61ecee56d1a1490cc285*",".{0,1000}a930c85fbceaf955c9ae865893b20a7164b0f8020b0a61ecee56d1a1490cc285.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*a99cbde533415b845c99754a3f454d205d6e31b11fe03e7dca01a8ff32f42646*",".{0,1000}a99cbde533415b845c99754a3f454d205d6e31b11fe03e7dca01a8ff32f42646.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*AA_v3.exe* -elevated*",".{0,1000}AA_v3\.exe.{0,1000}\s\-elevated.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AA_v3.exe* -service -lunch*",".{0,1000}AA_v3\.exe.{0,1000}\s\-service\s\-lunch.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*aa530e906b1a52f4f72f7a0c50c1599df651cc4ce38331365d74dff9c51b98fb*",".{0,1000}aa530e906b1a52f4f72f7a0c50c1599df651cc4ce38331365d74dff9c51b98fb.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*aaba6ec560adf31f057113fc8c2e0f2387c9643206f9085e4179c109afcdd396*",".{0,1000}aaba6ec560adf31f057113fc8c2e0f2387c9643206f9085e4179c109afcdd396.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ac1f545786b7014c5a247d8854f114611814ed5f63232a9098f549732fa8814d*",".{0,1000}ac1f545786b7014c5a247d8854f114611814ed5f63232a9098f549732fa8814d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ac6ea42ae4f70b4b8bc0f1c0f6e453447d97c0f13eb5e2e1621765b304e43cdb*",".{0,1000}ac6ea42ae4f70b4b8bc0f1c0f6e453447d97c0f13eb5e2e1621765b304e43cdb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*acontrol.atera.com*",".{0,1000}acontrol\.atera\.com.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Action1 Corporation*",".{0,1000}Action1\sCorporation.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Action1 Endpoint Security*",".{0,1000}Action1\sEndpoint\sSecurity.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","product name","10","10","N/A","N/A","N/A","N/A"
"*Action1*'DestinationPort'>22543*",".{0,1000}Action1.{0,1000}\'DestinationPort\'\>22543.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Action1\batch_data\Run_Script__*",".{0,1000}Action1\\batch_data\\Run_Script__.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Action1\first_install.tmp*",".{0,1000}Action1\\first_install\.tmp.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Action1\what_is_this.txt*",".{0,1000}Action1\\what_is_this\.txt.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*action1_agent.exe*",".{0,1000}action1_agent\.exe.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*action1_agent.exe.connection*",".{0,1000}action1_agent\.exe\.connection.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*action1_remote.exe*",".{0,1000}action1_remote\.exe.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*action1_update.exe*",".{0,1000}action1_update\.exe.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*activate.netsupportsoftware.com*",".{0,1000}activate\.netsupportsoftware\.com.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*admin.*.swi-dre.com*",".{0,1000}admin\..{0,1000}\.swi\-dre\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Advanced Monitoring Agent HTTP Retriever 1.1*",".{0,1000}Advanced\sMonitoring\sAgent\sHTTP\sRetriever\s1\.1.{0,1000}","greyware_tool_keyword","Nsight RMM","Nsight RMM usage","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Scattered Spider*","RMM","https://www.n-able.com/products/n-sight-rmm","1","1","N/A","user-agent","10","10","N/A","N/A","N/A","N/A"
"*aeabd0eed04e87b955809822a4696df781a25ccb649f097a523d1cb4cf93a567*",".{0,1000}aeabd0eed04e87b955809822a4696df781a25ccb649f097a523d1cb4cf93a567.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","#filehash","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*Aeroadmin LLC*",".{0,1000}Aeroadmin\sLLC.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","#companyname","N/A","10","10","N/A","N/A","N/A","N/A"
"*AeroAdmin PRO - remote desktop.exe*",".{0,1000}AeroAdmin\sPRO\s\-\sremote\sdesktop\.exe.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AeroAdmin PRO.exe*",".{0,1000}AeroAdmin\sPRO\.exe.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AeroAdmin v4.* (*",".{0,1000}AeroAdmin\sv4\..{0,1000}\s\(.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AeroAdmin.cpp*",".{0,1000}AeroAdmin\.cpp.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AEROADMIN.EXE-*.pf*",".{0,1000}AEROADMIN\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Aeroadmin\Screenshots*",".{0,1000}Aeroadmin\\Screenshots.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AeroAdmin_2.exe*",".{0,1000}AeroAdmin_2\.exe.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AeroadminService*",".{0,1000}AeroadminService.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","Service Name","10","10","N/A","N/A","N/A","N/A"
"*af1fa340c0d3690024a828f2099482530d20351bafcd114860b7faf37ddf11cb*",".{0,1000}af1fa340c0d3690024a828f2099482530d20351bafcd114860b7faf37ddf11cb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*agent.fleetdeck.io/*?win*",".{0,1000}agent\.fleetdeck\.io\/.{0,1000}\?win.{0,1000}","greyware_tool_keyword","fleetdeck","FleetDeck is a Remote Desktop & Virtual Terminal solution tailored for techs to  manage large fleets of computers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://fleetdeck.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*agent01.xeox.com*",".{0,1000}agent01\.xeox\.com.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*agent-api.atera.com*",".{0,1000}agent\-api\.atera\.com.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AgentCore/MeshServer_*",".{0,1000}AgentCore\/MeshServer_.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*AgentPackageInternalPooler\log.txt*",".{0,1000}AgentPackageInternalPooler\\log\.txt.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AgentPackageRunCommandInteractive\log.txt*",".{0,1000}AgentPackageRunCommandInteractive\\log\.txt.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*agents.level.io*",".{0,1000}agents\.level\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AlphaControlAgent.CloudLogsManager+<>*",".{0,1000}AlphaControlAgent\.CloudLogsManager\+\<\>.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*alt.meshcentral.com*",".{0,1000}alt\.meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*amidaware/tacticalrmm*",".{0,1000}amidaware\/tacticalrmm.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*Ammyy Admin*",".{0,1000}Ammyy\sAdmin.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","#companyname","N/A","10","10","N/A","N/A","N/A","N/A"
"*Ammyy LLC*",".{0,1000}Ammyy\sLLC.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AMMYY_Admin.exe*",".{0,1000}AMMYY_Admin\.exe.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AnyDesk Software GmbH*",".{0,1000}AnyDesk\sSoftware\sGmbH.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","#companyname","N/A","10","10","N/A","N/A","N/A","N/A"
"*Anydesk* --start-with-win --silent*",".{0,1000}Anydesk.{0,1000}\s\-\-start\-with\-win\s\-\-silent.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*anydesk.exe --set-password*",".{0,1000}anydesk\.exe\s\-\-set\-password.{0,1000}","greyware_tool_keyword","anydesk","setting the AnyDesk service password manually","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/","1","0","N/A","N/A","5","10","N/A","N/A","N/A","N/A"
"*Anydesk\ad.trace*",".{0,1000}Anydesk\\ad\.trace.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.inversecos.com/2021/02/forensic-analysis-of-anydesk-logs.html","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*AnyplaceControlInstall.exe*",".{0,1000}AnyplaceControlInstall\.exe.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AnyViewer\audio_sniffer.dll*",".{0,1000}AnyViewer\\audio_sniffer\.dll.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AnyViewer\AVCore.exe*",".{0,1000}AnyViewer\\AVCore\.exe.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AnyViewer\RCService.exe*",".{0,1000}AnyViewer\\RCService\.exe.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AnyViewer\ScreanCap.exe*",".{0,1000}AnyViewer\\ScreanCap\.exe.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AnyViewer\SplashWin.exe*",".{0,1000}AnyViewer\\SplashWin\.exe.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*api/v1/fleet/sso/callback*",".{0,1000}api\/v1\/fleet\/sso\/callback.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*api-telemetry.servers.getgo.com*",".{0,1000}api\-telemetry\.servers\.getgo\.com.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AppData\Local\Temp\RemotePC Attended*",".{0,1000}AppData\\Local\\Temp\\RemotePC\sAttended.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AppData\Local\Temp\TeamViewer*",".{0,1000}AppData\\Local\\Temp\\TeamViewer.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*AppData\Roaming\Microsoft\Windows\SendTo\TeamViewer.lnk*",".{0,1000}AppData\\Roaming\\Microsoft\\Windows\\SendTo\\TeamViewer\.lnk.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*application/x-supremo*",".{0,1000}application\/x\-supremo.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ApplicationName'>GoTo Opener*",".{0,1000}ApplicationName\'\>GoTo\sOpener.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ApplicationName'>GoToMyPC Communications*",".{0,1000}ApplicationName\'\>GoToMyPC\sCommunications.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ApplicationName'>GoToMyPC Host Launcher*",".{0,1000}ApplicationName\'\>GoToMyPC\sHost\sLauncher.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ApplicationName'>GoToMyPC Viewer*",".{0,1000}ApplicationName\'\>GoToMyPC\sViewer.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*asapi.aweray.net*",".{0,1000}asapi\.aweray\.net.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*assist.zoho.com*",".{0,1000}assist\.zoho\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Assistencia Rapida Installer.exe*",".{0,1000}Assistencia\sRapida\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*as-tk.aweray.com*",".{0,1000}as\-tk\.aweray\.com.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*as-tk.aweray.com/track*",".{0,1000}as\-tk\.aweray\.com\/track.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*atera_del.bat*",".{0,1000}atera_del\.bat.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*atera_del2.bat*",".{0,1000}atera_del2\.bat.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AteraAgent*AgentPackageRunCommandInteractive.exe*",".{0,1000}AteraAgent.{0,1000}AgentPackageRunCommandInteractive\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AteraSetupLog.txt*",".{0,1000}AteraSetupLog\.txt.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*auth*.aeroadmin.com*",".{0,1000}auth.{0,1000}\.aeroadmin\.com.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*auth11.aeroadmin.com*",".{0,1000}auth11\.aeroadmin\.com.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*auvik.agent.exe*",".{0,1000}auvik\.agent\.exe.{0,1000}","greyware_tool_keyword","auvik","cloud-based network management software","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.auvik.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*AuvikService.exe*",".{0,1000}AuvikService\.exe.{0,1000}","greyware_tool_keyword","auvik","cloud-based network management software","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.auvik.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Aweray_Remote.exe*",".{0,1000}Aweray_Remote\.exe.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*awerayimg.com*",".{0,1000}awerayimg\.com.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*b069bee7a2a19e296886fb26862e7432e0b2a0fbde72db072f369a0c0e990955*",".{0,1000}b069bee7a2a19e296886fb26862e7432e0b2a0fbde72db072f369a0c0e990955.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*b11045e6accfd5cfa54afed6cfdfc2203873efe7541aa5a93f920d71d3a517b0*",".{0,1000}b11045e6accfd5cfa54afed6cfdfc2203873efe7541aa5a93f920d71d3a517b0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*b31716aa1e425286ea9372e2f72fa7e99e5df62dbe9ac54838d55a877a45abe1*",".{0,1000}b31716aa1e425286ea9372e2f72fa7e99e5df62dbe9ac54838d55a877a45abe1.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*b3f41948b9d55320be0884cdf9634a30089348e31bcb8a6675f75094167c741e*",".{0,1000}b3f41948b9d55320be0884cdf9634a30089348e31bcb8a6675f75094167c741e.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*b4aa7c480ce02aeb723529ed5e8c2874738ca4d2aeb9e718cdc96c5e5cbded3b*",".{0,1000}b4aa7c480ce02aeb723529ed5e8c2874738ca4d2aeb9e718cdc96c5e5cbded3b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*b7678c523152e65ff7b537cafde3fd5ef076ea35e59c3c9148b44a7e6aee796d*",".{0,1000}b7678c523152e65ff7b537cafde3fd5ef076ea35e59c3c9148b44a7e6aee796d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*b8e073c828b106964df38c2a16c30d9acae5aac15a2b4204f084bdf2579c3145*",".{0,1000}b8e073c828b106964df38c2a16c30d9acae5aac15a2b4204f084bdf2579c3145.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*b9ccd13469c5223264dd92b763eff1f27dedd86aa9a2068a08fadce9527e7e71*",".{0,1000}b9ccd13469c5223264dd92b763eff1f27dedd86aa9a2068a08fadce9527e7e71.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*b9eb20c7cddd46e2b79c6dab5f85943439333c710bdf6d27fe930a44a6ccb042*",".{0,1000}b9eb20c7cddd46e2b79c6dab5f85943439333c710bdf6d27fe930a44a6ccb042.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ba2b81d69ca915132c560a787698e84bf530236a234dd7163e391feb82858bb0*",".{0,1000}ba2b81d69ca915132c560a787698e84bf530236a234dd7163e391feb82858bb0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*Backdoor.Quasar*",".{0,1000}Backdoor\.Quasar.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Barracuda RMM Onsite Manager - InstallShield Wizard*",".{0,1000}Barracuda\sRMM\sOnsite\sManager\s\-\sInstallShield\sWizard.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Barracuda RMM Onsite Manager.msi*",".{0,1000}Barracuda\sRMM\sOnsite\sManager\.msi.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*bd7c78ae36f84966ffd5effbb9f9227d1a018d8cdb51a2e4e883d4d113453304*",".{0,1000}bd7c78ae36f84966ffd5effbb9f9227d1a018d8cdb51a2e4e883d4d113453304.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*beyondtrustcloud.com\Software\Qt6*",".{0,1000}beyondtrustcloud\.com\\Software\\Qt6.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*bf2893ace82d8952c00dfaefc48cfb09e2d58fc2cf3553aadfdc250f4b03ccbd*",".{0,1000}bf2893ace82d8952c00dfaefc48cfb09e2d58fc2cf3553aadfdc250f4b03ccbd.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*bfb8b8f3ed04f539f694f140dcf8fdbe07b4e96dfcf8fea3d555d1b69e14b384*",".{0,1000}bfb8b8f3ed04f539f694f140dcf8fdbe07b4e96dfcf8fea3d555d1b69e14b384.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*bfcf0d230e85b0d06d5fc6f19042169d856d2e6dd9a38214721a4cf97ae63af2*",".{0,1000}bfcf0d230e85b0d06d5fc6f19042169d856d2e6dd9a38214721a4cf97ae63af2.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*bfleegjcoffelppfmadimianphbcdjkb*",".{0,1000}bfleegjcoffelppfmadimianphbcdjkb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*bin\Remote AccessLauncher.exe*",".{0,1000}bin\\Remote\sAccessLauncher\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*bomgar-rdp.exe*",".{0,1000}bomgar\-rdp\.exe.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*boot.net.anydesk.com*",".{0,1000}boot\.net\.anydesk\.com.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","1","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*builds.level.io*",".{0,1000}builds\.level\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*bvba_UltraVNC_*_exe*",".{0,1000}bvba_UltraVNC_.{0,1000}_exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*C:\Program Files (x86)\AnyDesk*",".{0,1000}C\:\\Program\sFiles\s\(x86\)\\AnyDesk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*C:\Program Files\SolarWinds\Dameware Mini Remote Control x64\*",".{0,1000}C\:\\Program\sFiles\\SolarWinds\\Dameware\sMini\sRemote\sControl\sx64\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*C:\Users\mthcht\AppData\Roaming\DameWare Development\*",".{0,1000}C\:\\Users\\mthcht\\AppData\\Roaming\\DameWare\sDevelopment\\.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*C:\Windows\Action1\*",".{0,1000}C\:\\Windows\\Action1\\.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*C:\Windows\System32\config\systemprofile\AppData\Local\Action1*",".{0,1000}C\:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Action1.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*c08fd251db2d48d9eb48583b3b2209a8efda571ec6cdff6c7ebb22667ce3d360*",".{0,1000}c08fd251db2d48d9eb48583b3b2209a8efda571ec6cdff6c7ebb22667ce3d360.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c0ac4e96a2e27335de61a6ada3e55f96d66b9b01b7728456b93ba23a394183a8*",".{0,1000}c0ac4e96a2e27335de61a6ada3e55f96d66b9b01b7728456b93ba23a394183a8.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c0b17012581f088528c73adb9f228a99bad35ee0a9f74e1a93e688f95d11080f*",".{0,1000}c0b17012581f088528c73adb9f228a99bad35ee0a9f74e1a93e688f95d11080f.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*c0f76101eeb0225230ebae6e980fc1161eb5b3727c8d1fd9ccfe3ac1169ba5b7*",".{0,1000}c0f76101eeb0225230ebae6e980fc1161eb5b3727c8d1fd9ccfe3ac1169ba5b7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c18e861f5e44c1b731f14ddebcbbe4f6d4bd9ad24e71b49feb7d1ddde7cc1741*",".{0,1000}c18e861f5e44c1b731f14ddebcbbe4f6d4bd9ad24e71b49feb7d1ddde7cc1741.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c1ec990cba4b1e813de9ebc1bdf540bc5dada5d5521d3a339361d04c8d92c742*",".{0,1000}c1ec990cba4b1e813de9ebc1bdf540bc5dada5d5521d3a339361d04c8d92c742.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c22224a6e32bc2f071373a53c528513f993239f3a3bc52bfb0ed3d854fba86b5*",".{0,1000}c22224a6e32bc2f071373a53c528513f993239f3a3bc52bfb0ed3d854fba86b5.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c29a459fab2edd0e81e797886daa70c210bb123e55331416cb6f5bd74bef0e6a*",".{0,1000}c29a459fab2edd0e81e797886daa70c210bb123e55331416cb6f5bd74bef0e6a.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c38560c8536e3c4b0d7a072e373009b03aaf63e58114deef576808c82eb62596*",".{0,1000}c38560c8536e3c4b0d7a072e373009b03aaf63e58114deef576808c82eb62596.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c3f35c99bf40d43b4eaa759a92f9a1bc5fc3ddcd0f35d338302a9e88cbdf995a*",".{0,1000}c3f35c99bf40d43b4eaa759a92f9a1bc5fc3ddcd0f35d338302a9e88cbdf995a.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*c488cce70defe02c6a90ebdfe276d88f4fdaab9264e157588bdb0e6dba9c5a91*",".{0,1000}c488cce70defe02c6a90ebdfe276d88f4fdaab9264e157588bdb0e6dba9c5a91.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c5185db5e8a84cb5fcad17d8501c2fd8aadb451d5c54fdda88af3504b4c850df*",".{0,1000}c5185db5e8a84cb5fcad17d8501c2fd8aadb451d5c54fdda88af3504b4c850df.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c5e68c5635bed872ce6ac0c2be5395cc15c2dbaa5f0052b86575cdd0b762902e*",".{0,1000}c5e68c5635bed872ce6ac0c2be5395cc15c2dbaa5f0052b86575cdd0b762902e.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*c678c9a61d0faf3f0e030010615c3cca395d815f8c073ea171b20d4bdf221192*",".{0,1000}c678c9a61d0faf3f0e030010615c3cca395d815f8c073ea171b20d4bdf221192.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*c75e682dd8f063bd0c151b30095bae8061146928f6d8533ac983280ad2c6effc*",".{0,1000}c75e682dd8f063bd0c151b30095bae8061146928f6d8533ac983280ad2c6effc.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*c7bdf687d8aff0ab4ddb28fa9c633f416ae82b201f3c51898136c9a26631a7f1*",".{0,1000}c7bdf687d8aff0ab4ddb28fa9c633f416ae82b201f3c51898136c9a26631a7f1.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*C7C363BA-E5B6-4E18-9224-39BC8DA73172*",".{0,1000}C7C363BA\-E5B6\-4E18\-9224\-39BC8DA73172.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","#GUIDproject","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*c8d5f96c3f1d9054427004f52d87d081f0bd05e4f104eaee857c10bab7400c2d*",".{0,1000}c8d5f96c3f1d9054427004f52d87d081f0bd05e4f104eaee857c10bab7400c2d.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*cc94b15863602ae52934d4c3c08db27c61c1530a483093b82a1029a41c4fbd60*",".{0,1000}cc94b15863602ae52934d4c3c08db27c61c1530a483093b82a1029a41c4fbd60.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*cd12e8a285c77102487f04726b91bc649f9ad087a1e9a5546124a0cc7480c221*",".{0,1000}cd12e8a285c77102487f04726b91bc649f9ad087a1e9a5546124a0cc7480c221.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","#filehash","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*ce4fc109fa3b38b58035b1274318e8db4eac26aee424d0ae4fc8d4113146db52*",".{0,1000}ce4fc109fa3b38b58035b1274318e8db4eac26aee424d0ae4fc8d4113146db52.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*CE5AD78C-DBDF-4D81-9A69-41B1DF683115*",".{0,1000}CE5AD78C\-DBDF\-4D81\-9A69\-41B1DF683115.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","#GUIDproject","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*CE62CBEE-DAA8-4E5E-AAAA-1F6FC291AB94*",".{0,1000}CE62CBEE\-DAA8\-4E5E\-AAAA\-1F6FC291AB94.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","#GUIDproject","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*certutil.exe* -addstore ""TrustedPublisher""*ultravnc.cer*",".{0,1000}certutil\.exe.{0,1000}\s\-addstore\s\""TrustedPublisher\"".{0,1000}ultravnc\.cer.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*cf3de8f800852490f39fdacbe74627564494235f*",".{0,1000}cf3de8f800852490f39fdacbe74627564494235f.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*cf51ff263c4171a25b93703cad922ad1f4ca4a43eb93f4b4b6129a774acccefe*",".{0,1000}cf51ff263c4171a25b93703cad922ad1f4ca4a43eb93f4b4b6129a774acccefe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*cfa2c04ccd3a209c5a01db6de5b393dc2f1f038add46d45e957490c990a47c62*",".{0,1000}cfa2c04ccd3a209c5a01db6de5b393dc2f1f038add46d45e957490c990a47c62.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*CFCD0759E20F29C399C9D4210BE614E4E020BEE8*",".{0,1000}CFCD0759E20F29C399C9D4210BE614E4E020BEE8.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Channel IP for client: *@gmail.com/chromoting*",".{0,1000}Channel\sIP\sfor\sclient\:\s.{0,30}\@gmail\.com\/chromoting.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*chat.us.n-able.com*",".{0,1000}chat\.us\.n\-able\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Chrome remote desktop installation completed*",".{0,1000}Chrome\sremote\sdesktop\sinstallation\scompleted.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","windows event logs application provider name","10","10","N/A","N/A","N/A","N/A"
"*chrome-remote-desktop.service*",".{0,1000}chrome\-remote\-desktop\.service.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*chrome-remote-desktop_current_amd64.deb*",".{0,1000}chrome\-remote\-desktop_current_amd64\.deb.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*chromeremotedesktophost.msi*",".{0,1000}chromeremotedesktophost\.msi.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*chsh -s /bin/false ehorus*",".{0,1000}chsh\s\-s\s\/bin\/false\sehorus.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*client.teamviewer.com*",".{0,1000}client\.teamviewer\.com.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*client-api.aweray.com*",".{0,1000}client\-api\.aweray\.com.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*cmd.exe*\TEMP\ScreenConnect\*.cmd*",".{0,1000}cmd\.exe.{0,1000}\\TEMP\\ScreenConnect\\.{0,1000}\.cmd.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","screenconnect.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Command: beginsharing Result: {""responsename"":""beginsharing""*",".{0,1000}Command\:\sbeginsharing\sResult\:\s\{\""responsename\""\:\""beginsharing\"".{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*commanderupdate.fleetdeck.io*",".{0,1000}commanderupdate\.fleetdeck\.io.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*'Company'>Action1 Corporation*",".{0,1000}\'Company\'\>Action1\sCorporation.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'Company'>BeyondTrust</Data>*",".{0,1000}\'Company\'\>BeyondTrust\<\/Data\>.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'Company'>bomgar</Data>*",".{0,1000}\'Company\'\>bomgar\<\/Data\>.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'company'>n-able take control</data>*",".{0,1000}\'company\'\>n\-able\stake\scontrol\<\/data\>.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Company'>NetSupport Ltd</*",".{0,1000}Company\'\>NetSupport\sLtd\<\/.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'Company'>UltraVNC</Data>*",".{0,1000}\'Company\'\>UltraVNC\<\/Data\>.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#companyname","N/A","10","10","N/A","N/A","N/A","N/A"
"*comserver.corporate.beanywhere.com*",".{0,1000}comserver\.corporate\.beanywhere\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*contactsupportrelays4-prod.eastus.cloudapp.azure.com*",".{0,1000}contactsupportrelays4\-prod\.eastus\.cloudapp\.azure\.com.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*control.*.logmeinrescue.com*",".{0,1000}control\..{0,1000}\.logmeinrescue\.com.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*control.rsc-app*.logmeinrescue.com",".{0,1000}control\.rsc\-app.{0,1000}\.logmeinrescue\.com","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*controlserver.anyviewer.com*",".{0,1000}controlserver\.anyviewer\.com.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*CurrentControlSet\Services\A1Agent*",".{0,1000}CurrentControlSet\\Services\\A1Agent.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","#servicename #registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*CurrentVersion\Uninstall\Splashtop Inc.\*",".{0,1000}CurrentVersion\\Uninstall\\Splashtop\sInc\.\\.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*cwn-log-collector-production-clone.*.elasticbeanstalk.com*",".{0,1000}cwn\-log\-collector\-production\-clone\..{0,1000}\.elasticbeanstalk\.com.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*d12ea4fbcf04a2b0d848ed5b610b78055558e95b7cfd6461ee2e81ba4a7216b5*",".{0,1000}d12ea4fbcf04a2b0d848ed5b610b78055558e95b7cfd6461ee2e81ba4a7216b5.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*d1a23b9adddc0a6dc7806cb8fb9db94adc7263f2712f379dafe654ed38fc6bec*",".{0,1000}d1a23b9adddc0a6dc7806cb8fb9db94adc7263f2712f379dafe654ed38fc6bec.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*d2b2455b755476d0b35c721ccdb84432e51812ab646a9210137c1e85b90d7de4*",".{0,1000}d2b2455b755476d0b35c721ccdb84432e51812ab646a9210137c1e85b90d7de4.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","#filehash","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*d3881b865311e774107ee50db4ee9a27cce669ccdd40e92c1990c4f1ec73e523*",".{0,1000}d3881b865311e774107ee50db4ee9a27cce669ccdd40e92c1990c4f1ec73e523.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*d3e630985cb4b429375d79dd506842da176a9cbe4e0afb992c694cab48f3e7ce*",".{0,1000}d3e630985cb4b429375d79dd506842da176a9cbe4e0afb992c694cab48f3e7ce.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*d44e3a415d99266b1759d1e452d3cf115ae01acb822bdff471f19f90c2cf7426*",".{0,1000}d44e3a415d99266b1759d1e452d3cf115ae01acb822bdff471f19f90c2cf7426.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*d5f1ce259c6bc7d54e2f670d336d7cefa1246ad42bd6c81188f4dafb997a342a*",".{0,1000}d5f1ce259c6bc7d54e2f670d336d7cefa1246ad42bd6c81188f4dafb997a342a.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*d7102b8487a285583c69c54bf0bb7a40148eee6050e45ced1d0380bf83ae7aaa*",".{0,1000}d7102b8487a285583c69c54bf0bb7a40148eee6050e45ced1d0380bf83ae7aaa.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*d8445e3bd78bac3cc8f8a3f23b68ab971fb85ff061059f8256e41c6b892374f4*",".{0,1000}d8445e3bd78bac3cc8f8a3f23b68ab971fb85ff061059f8256e41c6b892374f4.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*DameWare Development Common Data\Mini Remote Control*",".{0,1000}DameWare\sDevelopment\sCommon\sData\\Mini\sRemote\sControl.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*DameWare Development\Agent Configuration*",".{0,1000}DameWare\sDevelopment\\Agent\sConfiguration.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*dameware remote everywhere agent - [dameware]*",".{0,1000}dameware\sremote\severywhere\sagent\s\-\s\[dameware\].{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*DameWare Remote Support.exe*",".{0,1000}DameWare\sRemote\sSupport\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*damewareagent.msi*",".{0,1000}damewareagent\.msi.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*damewareremoteeverywhereagent.exe*",".{0,1000}damewareremoteeverywhereagent\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*damewareremoteeverywhereconsole.exe*",".{0,1000}damewareremoteeverywhereconsole\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ddfb0598ad97db5738e82403d0e932d2df9591e7e2998f425b56360b75d56c71*",".{0,1000}ddfb0598ad97db5738e82403d0e932d2df9591e7e2998f425b56360b75d56c71.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*de04a4f93837236a62fcd753c4ae7f64ebdbd8880ee2faffd0b950dcc2bc744b*",".{0,1000}de04a4f93837236a62fcd753c4ae7f64ebdbd8880ee2faffd0b950dcc2bc744b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*de4be9f031e2d9d10bcc70a409aaa0e5d311460828d2c6a5404deaa4f7da98ea*",".{0,1000}de4be9f031e2d9d10bcc70a409aaa0e5d311460828d2c6a5404deaa4f7da98ea.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*de7cab0e59a003edd943523dfefa1d038ee1edd914548625fa97324ce680516b*",".{0,1000}de7cab0e59a003edd943523dfefa1d038ee1edd914548625fa97324ce680516b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*def26f6de141f3f90c975923f007cd0acf66422357d9dc78bbb2bdba3f7184a5*",".{0,1000}def26f6de141f3f90c975923f007cd0acf66422357d9dc78bbb2bdba3f7184a5.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*DEFAULT\Software\AeroAdmin*",".{0,1000}DEFAULT\\Software\\AeroAdmin.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*'Description'>Dameware products</Data>*",".{0,1000}\'Description\'\>Dameware\sproducts\<\/Data\>.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*'Description'>VNC server</Data>*",".{0,1000}\'Description\'\>VNC\sserver\<\/Data\>.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Desktop\AnyDesk.lnk*",".{0,1000}Desktop\\AnyDesk\.lnk.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*df1ecdc0031475f4481f32911d5222f265ca016bc23a2ce5febe24339f473c02*",".{0,1000}df1ecdc0031475f4481f32911d5222f265ca016bc23a2ce5febe24339f473c02.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*discordapp.com/attachments/*/AnyDesk.exe*",".{0,1000}discordapp\.com\/attachments\/.{0,1000}\/AnyDesk\.exe.{0,1000}","offensive_tool_keyword","anydesk","Fake Anydesk distributed by discord - mars stealer","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://www.virustotal.com/gui/url/f83616f0f9cd2337ed40e22b0a675a99d58edf004b31645f56f28f020f5e4f46/detection","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.anydesk.com*",".{0,1000}download\.anydesk\.com.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt","RMM","https://anydesk.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.global.mspa.n-able.com/*",".{0,1000}download\.global\.mspa\.n\-able\.com\/.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.radmin.com*",".{0,1000}download\.radmin\.com.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.radmin-vpn.com*",".{0,1000}download\.radmin\-vpn\.com.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.remotepc.com*",".{0,1000}download\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*download.teamviewer.com.cdn.cloudflare.net*",".{0,1000}download\.teamviewer\.com\.cdn\.cloudflare\.net.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*downloads.zohocdn.com*",".{0,1000}downloads\.zohocdn\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*downloads.zohodl.com.cn*",".{0,1000}downloads\.zohodl\.com\.cn.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*dwagent_install.log*",".{0,1000}dwagent_install\.log.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*dwagent_unistall.log*",".{0,1000}dwagent_unistall\.log.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*dwaggdi_x86_32.dll*",".{0,1000}dwaggdi_x86_32\.dll.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*dwaggdi_x86_64.dll*",".{0,1000}dwaggdi_x86_64\.dll.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*dwagscreencapture.dll*",".{0,1000}dwagscreencapture\.dll.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*dwagscreencapturebitblt.dll*",".{0,1000}dwagscreencapturebitblt\.dll.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*dwagscreencapturedesktopduplication.dll*",".{0,1000}dwagscreencapturedesktopduplication\.dll.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*dwservice/agent*",".{0,1000}dwservice\/agent.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*e010e0aa32e87164f562b23b09290e0cb1dd3a634beab90c015a7f6db2afc295*",".{0,1000}e010e0aa32e87164f562b23b09290e0cb1dd3a634beab90c015a7f6db2afc295.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e11e21d85234c890f047955456c220a95dfcb6f010fadd20fcb9e15ea43a4cf7*",".{0,1000}e11e21d85234c890f047955456c220a95dfcb6f010fadd20fcb9e15ea43a4cf7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*E377F156-BAED-4086-B534-3CC43164607A*",".{0,1000}E377F156\-BAED\-4086\-B534\-3CC43164607A.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","#GUIDproject","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*e3a9686198e872ef6984215ebcd18a3c2f57c8ca009dc3c23b485a88a92fff01*",".{0,1000}e3a9686198e872ef6984215ebcd18a3c2f57c8ca009dc3c23b485a88a92fff01.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e4997313fa56907981be64b670a5609df81c55ebeecc8fd26a8d7471c4f62317*",".{0,1000}e4997313fa56907981be64b670a5609df81c55ebeecc8fd26a8d7471c4f62317.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e54a67a249e4e87a3ee0ab2c0cd5edf58cd52eee67b5f2df4d15fad38c1880b3*",".{0,1000}e54a67a249e4e87a3ee0ab2c0cd5edf58cd52eee67b5f2df4d15fad38c1880b3.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e626c24d81970be447e683730e22ff4fccfbc720b6b9dff41bbd2f2419766380*",".{0,1000}e626c24d81970be447e683730e22ff4fccfbc720b6b9dff41bbd2f2419766380.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e73c16e92842b5e4889ca8e7b88901ddd5b59f85394e82ca8554c75d26250ebb*",".{0,1000}e73c16e92842b5e4889ca8e7b88901ddd5b59f85394e82ca8554c75d26250ebb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e7aed3b9cea264001849c7bb2bbd56a8772816c065663c6e954890a72be441b7*",".{0,1000}e7aed3b9cea264001849c7bb2bbd56a8772816c065663c6e954890a72be441b7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e7e6fcf7d0b2ce3732fbeb5c7e48bb4a2f9f8bbca49ad55d13a57e9abb661481*",".{0,1000}e7e6fcf7d0b2ce3732fbeb5c7e48bb4a2f9f8bbca49ad55d13a57e9abb661481.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*e84ef4bf8f7150620cdbb98da7f38f397eddc996b2b93dc7b00f8ae39a28635c*",".{0,1000}e84ef4bf8f7150620cdbb98da7f38f397eddc996b2b93dc7b00f8ae39a28635c.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e99d21c07b1b29361d6eb4895c350a36651536eb1719d50c802d5067c4b723c9*",".{0,1000}e99d21c07b1b29361d6eb4895c350a36651536eb1719d50c802d5067c4b723c9.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*e9ca78d11b144352ca1d9ec83d7ec0f44fba238ae3ba46560ed01b45eaa1f232*",".{0,1000}e9ca78d11b144352ca1d9ec83d7ec0f44fba238ae3ba46560ed01b45eaa1f232.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ebfdb029f616dcbd294b785874a77d5b62a08f92d562afb522309a07a36f472c*",".{0,1000}ebfdb029f616dcbd294b785874a77d5b62a08f92d562afb522309a07a36f472c.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*echo Installing XEOX Agent*",".{0,1000}echo\sInstalling\sXEOX\sAgent.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ed716e9d8a9382928e6a20bbac0f2245b7996125d9d86ace9c9a88fb9f8e4fde*",".{0,1000}ed716e9d8a9382928e6a20bbac0f2245b7996125d9d86ace9c9a88fb9f8e4fde.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*edb82e0716aa844b2d6d8ebfe4d4e08f41a0618fdd62b64623c8f590a39bc207*",".{0,1000}edb82e0716aa844b2d6d8ebfe4d4e08f41a0618fdd62b64623c8f590a39bc207.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ee3e0370955bb5c44e5a5370bdd268e5e948e18dbe86ae89e9f243f4a1668850*",".{0,1000}ee3e0370955bb5c44e5a5370bdd268e5e948e18dbe86ae89e9f243f4a1668850.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*EE54577067550559C4711C9E5E10435807F9DEEE9A5ADB4409CB60A6B0108700*",".{0,1000}EE54577067550559C4711C9E5E10435807F9DEEE9A5ADB4409CB60A6B0108700.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","0","#filehash","N/A","10","10","N/A","N/A","N/A","N/A"
"*ee5974d52512f1d5e55fafef9e04969656c1dd2fa5919376f81bf62b1a6a04e9*",".{0,1000}ee5974d52512f1d5e55fafef9e04969656c1dd2fa5919376f81bf62b1a6a04e9.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ef3cc05f5d86042c926a3243c081957445717960268743953793980df144b145*",".{0,1000}ef3cc05f5d86042c926a3243c081957445717960268743953793980df144b145.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ef67236f50b717490ba2d02669aac749eab81b805285e5780cb691006f26f742*",".{0,1000}ef67236f50b717490ba2d02669aac749eab81b805285e5780cb691006f26f742.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ef9ccb9743205b6cd63e965ded0ad5b6836d9c4f4d8b3bec5264bdfbf1c71651*",".{0,1000}ef9ccb9743205b6cd63e965ded0ad5b6836d9c4f4d8b3bec5264bdfbf1c71651.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ehorus_agent -f /etc/ehorus/*",".{0,1000}ehorus_agent\s\-f\s\/etc\/ehorus\/.{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*Elevate*\elev_win.exe*",".{0,1000}Elevate.{0,1000}\\elev_win\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*eval-*.beyondtrustcloud.com*",".{0,1000}eval\-.{0,1000}\.beyondtrustcloud\.com.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*export CHROME_REMOTE_DESKTOP_DEFAULT_DESKTOP_SIZES*",".{0,1000}export\sCHROME_REMOTE_DESKTOP_DEFAULT_DESKTOP_SIZES.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*f004ede766d83d38ded3358bef66fd56b564fcea19cde01f79dee4a426916448*",".{0,1000}f004ede766d83d38ded3358bef66fd56b564fcea19cde01f79dee4a426916448.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f0585309751d285f47ef51783422235b20248a430dc6daca9d13e4755fd02721*",".{0,1000}f0585309751d285f47ef51783422235b20248a430dc6daca9d13e4755fd02721.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f193e6dd7595ee4163e6299c5196dcee429046f0f99175f5058ddce9348057bf*",".{0,1000}f193e6dd7595ee4163e6299c5196dcee429046f0f99175f5058ddce9348057bf.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f263d762ee5788d2773d167ed15e6fc41e874f8682b6df9c8f8215c07c836275*",".{0,1000}f263d762ee5788d2773d167ed15e6fc41e874f8682b6df9c8f8215c07c836275.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f3c40d7fc7a91a57e7689ada1c1b6b7167f4a740bb2124ea1c3a75d0bde8030b*",".{0,1000}f3c40d7fc7a91a57e7689ada1c1b6b7167f4a740bb2124ea1c3a75d0bde8030b.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f3f3cc358d84f4adca20bf1ba7a0a08d733d54cfd6a62276b7b465a58902bf99*",".{0,1000}f3f3cc358d84f4adca20bf1ba7a0a08d733d54cfd6a62276b7b465a58902bf99.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f44a9e93bc06742004f0b5c74b00cf0689b4890b903803c338ef80b9fd69c173*",".{0,1000}f44a9e93bc06742004f0b5c74b00cf0689b4890b903803c338ef80b9fd69c173.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f4be7647922d6d458692d149c3aec12c3ecd84ed97761dd5478b1e10cbb94d7e*",".{0,1000}f4be7647922d6d458692d149c3aec12c3ecd84ed97761dd5478b1e10cbb94d7e.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f6b2697a2c40fee8c1aeac7133b205797cf4d877500e96951199c06422a66e33*",".{0,1000}f6b2697a2c40fee8c1aeac7133b205797cf4d877500e96951199c06422a66e33.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f7a9240b781a22fc573a4780da8dadaa761853d1247f21b9306083962e0197d0*",".{0,1000}f7a9240b781a22fc573a4780da8dadaa761853d1247f21b9306083962e0197d0.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*f99653446a9eb4dbc8bb2bcbef659f8fe2af69d5ad9319eaba68c394cb1c2b06*",".{0,1000}f99653446a9eb4dbc8bb2bcbef659f8fe2af69d5ad9319eaba68c394cb1c2b06.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fa1883bb377e2154c9dc766235f92612b8187ce2121f5ba3c3da28f1ebe6de63*",".{0,1000}fa1883bb377e2154c9dc766235f92612b8187ce2121f5ba3c3da28f1ebe6de63.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*FAECC814-3F3F-4CA0-8C2B-72D5E4670B92*",".{0,1000}FAECC814\-3F3F\-4CA0\-8C2B\-72D5E4670B92.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#GUIDproject","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fb998e66174bc1cee14dff001bec28d4a43ad753885a95f25015d71db8ff39fb*",".{0,1000}fb998e66174bc1cee14dff001bec28d4a43ad753885a95f25015d71db8ff39fb.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fc9a33902b9f6efc6ade3bd7cff30f476d6e7fcfa68d57d063c3ec03f8ac2bf8*",".{0,1000}fc9a33902b9f6efc6ade3bd7cff30f476d6e7fcfa68d57d063c3ec03f8ac2bf8.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fd075f9c84e91c2f7c0937e730df44f3e9fe9b74c41bdf62645a9798cd1a45c5*",".{0,1000}fd075f9c84e91c2f7c0937e730df44f3e9fe9b74c41bdf62645a9798cd1a45c5.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fe4a85694ea1405552e8bd6fabbff0a676ff428a529fb72e23ca48ca0d2f9ba7*",".{0,1000}fe4a85694ea1405552e8bd6fabbff0a676ff428a529fb72e23ca48ca0d2f9ba7.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ff91f0d3a6ffcf273c455b50cd84d306e03e1ec0b650175bee3dde1480d1d113*",".{0,1000}ff91f0d3a6ffcf273c455b50cd84d306e03e1ec0b650175bee3dde1480d1d113.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","#filehash","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*ff98ae3248a0c2d93b00ec2d426578a3b90aec301883662b8da0fb2a213d60ca*",".{0,1000}ff98ae3248a0c2d93b00ec2d426578a3b90aec301883662b8da0fb2a213d60ca.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#filehash","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*FFE5AD77-8AF4-4A3F-8CE7-6BDC45565F07*",".{0,1000}FFE5AD77\-8AF4\-4A3F\-8CE7\-6BDC45565F07.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","#GUIDproject","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*firewall add allowedprogram *vncviewer.exe* ENABLE ALL*",".{0,1000}firewall\sadd\sallowedprogram\s.{0,1000}vncviewer\.exe.{0,1000}\sENABLE\sALL.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*firewall add allowedprogram *winvnc.exe* ENABLE ALL*",".{0,1000}firewall\sadd\sallowedprogram\s.{0,1000}winvnc\.exe.{0,1000}\sENABLE\sALL.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*firewall add portopening TCP 5800 vnc5800*",".{0,1000}firewall\sadd\sportopening\sTCP\s5800\svnc5800.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*firewall add portopening TCP 5900 vnc5900*",".{0,1000}firewall\sadd\sportopening\sTCP\s5900\svnc5900.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*firewall add rule ""name=SH Remote Access Service Launcher""*",".{0,1000}firewall\sadd\srule\s\""name\=SH\sRemote\sAccess\sService\sLauncher\"".{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*firewall add rule ""name=SH Remote Access Service Updater""*",".{0,1000}firewall\sadd\srule\s\""name\=SH\sRemote\sAccess\sService\sUpdater\"".{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*firewall add rule ""name=SH Remote Access Service""*",".{0,1000}firewall\sadd\srule\s\""name\=SH\sRemote\sAccess\sService\"".{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*fleetctl updates init*",".{0,1000}fleetctl\supdates\sinit.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fleetdeck.io/prototype3/commander_svc*",".{0,1000}fleetdeck\.io\/prototype3\/commander_svc.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fleetdeck_agent.exe*",".{0,1000}fleetdeck_agent\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fleetdeck_agent_svc.exe*",".{0,1000}fleetdeck_agent_svc\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fleetdeck_commander_launcher.exe*",".{0,1000}fleetdeck_commander_launcher\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fleetdeck_commander_svc.exe*",".{0,1000}fleetdeck_commander_svc\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fleetdeck_installer.exe*",".{0,1000}fleetdeck_installer\.exe.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*fleetdeckfork/execfuncargs(*",".{0,1000}fleetdeckfork\/execfuncargs\(.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*-Force Stop-Process -Name remote_webauthn*",".{0,1000}\-Force\sStop\-Process\s\-Name\sremote_webauthn.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*g_hDesk = Funcs::pOpenDesktopA(g_desktopName*",".{0,1000}g_hDesk\s\=\sFuncs\:\:pOpenDesktopA\(g_desktopName.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*G2MScrUtil64.exe*/cr*",".{0,1000}G2MScrUtil64\.exe.{0,1000}\/cr.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*g2mui.exe*/cr*",".{0,1000}g2mui\.exe.{0,1000}\/cr.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*gateway.zohoassist.com*",".{0,1000}gateway\.zohoassist\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*geo.netsupportsoftware.com*",".{0,1000}geo\.netsupportsoftware\.com.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*getsupportservice_common_dameware\logs*",".{0,1000}getsupportservice_common_dameware\\logs.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*github.com/rossja/TinyNuke*",".{0,1000}github\.com\/rossja\/TinyNuke.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","1","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*GlavSoft LLC.*",".{0,1000}GlavSoft\sLLC\..{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*google-chrome-stable_current_amd64.deb*",".{0,1000}google\-chrome\-stable_current_amd64\.deb.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GoTo MyPC Installer.exe*",".{0,1000}GoTo\sMyPC\sInstaller\.exe.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GOTO MYPC INSTALLER.EXE-*.pf*",".{0,1000}GOTO\sMYPC\sINSTALLER\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GoTo Opener.exe *",".{0,1000}GoTo\sOpener\.exe\s.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GOTO OPENER.EXE-*.pf*",".{0,1000}GOTO\sOPENER\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Goto.exe*?type=crashpad-handler*",".{0,1000}Goto\.exe.{0,1000}\?type\=crashpad\-handler.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GoToMyPC_Installation.log*",".{0,1000}GoToMyPC_Installation\.log.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GoToMyPC_Setup.log*",".{0,1000}GoToMyPC_Setup\.log.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GoToMyPCSetup_x64.msi*",".{0,1000}GoToMyPCSetup_x64\.msi.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*GoToScrUtils.exe*/cr*",".{0,1000}GoToScrUtils\.exe.{0,1000}\/cr.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*HiddenDesktop.cpp*",".{0,1000}HiddenDesktop\.cpp.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*HiddenDesktop.exe*",".{0,1000}HiddenDesktop\.exe.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","1","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*HiddenDesktop_ControlWindow*",".{0,1000}HiddenDesktop_ControlWindow.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*HKCR\.anydesk\*",".{0,1000}HKCR\\\.anydesk\\.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*HKCR\.vnc*",".{0,1000}HKCR\\\.vnc.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*HKCR\.vnc*",".{0,1000}HKCR\\\.vnc.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*HKCR\nsm\shell\open\command*",".{0,1000}HKCR\\nsm\\shell\\open\\command.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*HKCR\NSScriptFile\*",".{0,1000}HKCR\\NSScriptFile\\.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*HKCR\REMOTEPC*",".{0,1000}HKCR\\REMOTEPC.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*HKCR\supremo\shell\*",".{0,1000}HKCR\\supremo\\shell\\.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*HKEY_CLASSES_ROOT\rustdesk*",".{0,1000}HKEY_CLASSES_ROOT\\rustdesk.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*HKEY_CURRENT_USER\Software\ATERA Networks*",".{0,1000}HKEY_CURRENT_USER\\Software\\ATERA\sNetworks.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*HKEY_LOCAL_MACHINE\SOFTWARE\ATERA Networks*",".{0,1000}HKEY_LOCAL_MACHINE\\SOFTWARE\\ATERA\sNetworks.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Radmin\*",".{0,1000}HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Radmin\\.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*HKLM\SOFTWARE\TeamViewer*",".{0,1000}HKLM\\SOFTWARE\\TeamViewer.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","#registry","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*HKLM\System\CurrentControlSet\Services\Client32*",".{0,1000}HKLM\\System\\CurrentControlSet\\Services\\Client32.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*http*/agent-api-*.atera.com*",".{0,1000}http.{0,1000}\/agent\-api\-.{0,1000}\.atera\.com.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*http://localhost:1337*",".{0,1000}http\:\/\/localhost\:1337.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*http://localhost:1337/previewlogin*",".{0,1000}http\:\/\/localhost\:1337\/previewlogin.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*https://*.my.auvik.com/*",".{0,1000}https\:\/\/.{0,1000}\.my\.auvik\.com\/.{0,1000}","greyware_tool_keyword","auvik","cloud-based network management software","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.auvik.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.pulseway.com/app/main/*",".{0,1000}https\:\/\/.{0,1000}\.pulseway\.com\/app\/main\/.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.screenconnect.com/Bin/*.exe*",".{0,1000}https\:\/\/.{0,1000}\.screenconnect\.com\/Bin\/.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","screenconnect.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.screenconnect.com/Host*",".{0,1000}https\:\/\/.{0,1000}\.screenconnect\.com\/Host.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.tacticalrmm.com/*",".{0,1000}https\:\/\/.{0,1000}\.tacticalrmm\.com\/.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*https://*.zoho.com/pconnect*",".{0,1000}https\:\/\/.{0,1000}\.zoho\.com\/pconnect.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://*.zohoassist.com/w_socket*",".{0,1000}https\:\/\/.{0,1000}\.zohoassist\.com\/w_socket.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://app.action1.com/agent/*/Windows/*.msi*",".{0,1000}https\:\/\/app\.action1\.com\/agent\/.{0,1000}\/Windows\/.{0,1000}\.msi.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","N/A","https://app.action1.com/agent/{ID}/Windows/agent(My_Organization).msi","10","10","N/A","N/A","N/A","N/A"
"*https://app.level.io/devices*",".{0,1000}https\:\/\/app\.level\.io\/devices.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/assist-join?key=*",".{0,1000}https\:\/\/assist\.zoho\.com\/assist\-join\?key\=.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/customer-session-details?client_token=*",".{0,1000}https\:\/\/assist\.zoho\.com\/customer\-session\-details\?client_token\=.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/join?join_source=EMAIL_INVITE*",".{0,1000}https\:\/\/assist\.zoho\.com\/join\?join_source\=EMAIL_INVITE.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/join-session?key=*",".{0,1000}https\:\/\/assist\.zoho\.com\/join\-session\?key\=.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/org/*",".{0,1000}https\:\/\/assist\.zoho\.com\/org\/.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://assist.zoho.com/viewer-assist*",".{0,1000}https\:\/\/assist\.zoho\.com\/viewer\-assist.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://cloud.screenconnect.com/#/trialtoinstance?cookieValue=*",".{0,1000}https\:\/\/cloud\.screenconnect\.com\/\#\/trialtoinstance\?cookieValue\=.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://docs.level.io/1.0/admin-guides/level-watchdog-task*",".{0,1000}https\:\/\/docs\.level\.io\/1\.0\/admin\-guides\/level\-watchdog\-task.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.level.io/install_linux.sh*",".{0,1000}https\:\/\/downloads\.level\.io\/install_linux\.sh.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.level.io/install_mac_os.sh*",".{0,1000}https\:\/\/downloads\.level\.io\/install_mac_os\.sh.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.level.io/install_windows.exe*",".{0,1000}https\:\/\/downloads\.level\.io\/install_windows\.exe.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.level.io/stable/level-linux-amd64*",".{0,1000}https\:\/\/downloads\.level\.io\/stable\/level\-linux\-amd64.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://downloads.solarwinds.com/solarwinds/Release/DameWare/*",".{0,1000}https\:\/\/downloads\.solarwinds\.com\/solarwinds\/Release\/DameWare\/.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*https://fleetdm.com/resources/install-fleetctl.sh*",".{0,1000}https\:\/\/fleetdm\.com\/resources\/install\-fleetctl\.sh.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","1","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*https://ip138.com/iplookup.asp?ip=*&action=2*",".{0,1000}https\:\/\/ip138\.com\/iplookup\.asp\?ip\=.{0,1000}\&action\=2.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://login.remotepc.com/rpcnew*",".{0,1000}https\:\/\/login\.remotepc\.com\/rpcnew.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://meshcentral.com/login*",".{0,1000}https\:\/\/meshcentral\.com\/login.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","1","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*https://nsproducts.azureedge.net/nsm-*/NetSupport*",".{0,1000}https\:\/\/nsproducts\.azureedge\.net\/nsm\-.{0,1000}\/NetSupport.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://portal.xeox.com/*",".{0,1000}https\:\/\/portal\.xeox\.com\/.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://pubsub.zoho.com/*_deskUserPresence/pubsub*",".{0,1000}https\:\/\/pubsub\.zoho\.com\/.{0,1000}_deskUserPresence\/pubsub.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://rdprelay*.support.services.microsoft.com*",".{0,1000}https\:\/\/rdprelay.{0,1000}\.support\.services\.microsoft\.com.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*https://remoteassistance.support.services.microsoft.com/*",".{0,1000}https\:\/\/remoteassistance\.support\.services\.microsoft\.com\/.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","1","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*https://remotedesktop.google.com/_/oauthredirect*",".{0,1000}https\:\/\/remotedesktop\.google\.com\/_\/oauthredirect.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://remotedesktop.google.com/headless*",".{0,1000}https\:\/\/remotedesktop\.google\.com\/headless.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://secure.logmeinrescue.com/R?i=2&Code=*",".{0,1000}https\:\/\/secure\.logmeinrescue\.com\/R\?i\=2\&Code\=.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://secure.logmeinrescue.com/TechnicianConsole/Launch*",".{0,1000}https\:\/\/secure\.logmeinrescue\.com\/TechnicianConsole\/Launch.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://sun.aweray.com/*/download*",".{0,1000}https\:\/\/sun\.aweray\.com\/.{0,1000}\/download.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*https://us4-wms6.zoho.com*",".{0,1000}https\:\/\/us4\-wms6\.zoho\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*HVNC - Tinynuke Clone [Melted@HF]*",".{0,1000}HVNC\s\-\sTinynuke\sClone\s\[Melted\@HF\].{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*HVNC - Tinynuke Clone*",".{0,1000}HVNC\s\-\sTinynuke\sClone.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*Incoming cmd Message: {""command"":""beginsharing""*",".{0,1000}Incoming\scmd\sMessage\:\s\{\""command\""\:\""beginsharing\"".{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*info.meshcentral.com*",".{0,1000}info\.meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*Info: {""command"":""forwardtoagent"", ""context"":{""command"":""requestresponse"",""context"":{""responsename"":""beginsharing*",".{0,1000}Info\:\s\{\""command\""\:\""forwardtoagent\"",\s\""context\""\:\{\""command\""\:\""requestresponse\"",\""context\""\:\{\""responsename\""\:\""beginsharing.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*Info: {""command"":""rdp_native_event"", ""context"":{ ""eventname"":""rdp_native_relay_connection_succeeded""} *",".{0,1000}Info\:\s\{\""command\""\:\""rdp_native_event\"",\s\""context\""\:\{\s\""eventname\""\:\""rdp_native_relay_connection_succeeded\""\}\s.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*info@rustdesk.com*",".{0,1000}info\@rustdesk\.com.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","#email","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*inomeogfingihgjfjlpeplalcfajhgai*",".{0,1000}inomeogfingihgjfjlpeplalcfajhgai.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*install.bat AweSun*",".{0,1000}install\.bat\sAweSun.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*InternetIdService.exe*",".{0,1000}InternetIdService\.exe.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*InventoryApplicationFile\action1_agent.ex*",".{0,1000}InventoryApplicationFile\\action1_agent\.ex.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*InventoryApplicationFile\action1_remote.e*",".{0,1000}InventoryApplicationFile\\action1_remote\.e.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ip.remotepc.com*",".{0,1000}ip\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","network","10","10","N/A","N/A","N/A","N/A"
"*ITarianRemoteAccessSetup.exe*",".{0,1000}ITarianRemoteAccessSetup\.exe.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*KASEYA HOLDINGS INC.*",".{0,1000}KASEYA\sHOLDINGS\sINC\..{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*launcher-rest-new.live.corecollab.ucc-prod.eva.goto.com*",".{0,1000}launcher\-rest\-new\.live\.corecollab\.ucc\-prod\.eva\.goto\.com.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*LEVEL_API_KEY=* bash -c ""$(curl -L *",".{0,1000}LEVEL_API_KEY\=.{0,1000}\sbash\s\-c\s\""\$\(curl\s\-L\s.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*license.bomgar.com*",".{0,1000}license\.bomgar\.com.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Linux ITSM Agent/* -e /tmp/install.sh *",".{0,1000}Linux\sITSM\sAgent\/.{0,1000}\s\-e\s\/tmp\/install\.sh\s.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*LMI_RescueRC.exe*",".{0,1000}LMI_RescueRC\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*LMIGuardianDll.dll*",".{0,1000}LMIGuardianDll\.dll.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*LMIGuardianSvc.exe*",".{0,1000}LMIGuardianSvc\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*localhost:4782*",".{0,1000}localhost\:4782.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*login.remotepc.com*",".{0,1000}login\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","network","10","10","N/A","N/A","N/A","N/A"
"*login.swi-dre.com*",".{0,1000}login\.swi\-dre\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*LogMeIn Rescue Technician Console.lnk*",".{0,1000}LogMeIn\sRescue\sTechnician\sConsole\.lnk.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*LogMeInRescueTechnicianConsoleApp.msi*",".{0,1000}LogMeInRescueTechnicianConsoleApp\.msi.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*logs.logdna.com*",".{0,1000}logs\.logdna\.com.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'M', 'E', 'L', 'T', 'E', 'D', 0*",".{0,1000}\'M\',\s\'E\',\s\'L\',\s\'T\',\s\'E\',\s\'D\',\s0.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*Manage Remote Access Service.exe*",".{0,1000}Manage\sRemote\sAccess\sService\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*managedsupport.kaseya.net*",".{0,1000}managedsupport\.kaseya\.net.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*mdmsupport.comodo.com*",".{0,1000}mdmsupport\.comodo\.com.{0,1000}","greyware_tool_keyword","ComodoRMM (Itarian RMM)","Comodo offers IT Remote Management tools includes RMM Software - Remote Access - Service Desk - Patch Management and Network Assessment (Itarian RMM)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://one.comodo.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*melted@xmpp.jp*",".{0,1000}melted\@xmpp\.jp.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","#email","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*Meltedd/HVNC*",".{0,1000}Meltedd\/HVNC.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","1","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*MESH_AGENT_PORT*",".{0,1000}MESH_AGENT_PORT.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*MESH_AGENT_STUN_PORT*",".{0,1000}MESH_AGENT_STUN_PORT.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*MeshAgent Crash Dumps*",".{0,1000}MeshAgent\sCrash\sDumps.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent.exe*",".{0,1000}meshagent\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent.js*",".{0,1000}meshagent\.js.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgent.mpkg*",".{0,1000}MeshAgent\.mpkg.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent.pid*",".{0,1000}meshagent\.pid.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent.service*",".{0,1000}meshagent\.service.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent.zip*",".{0,1000}meshagent\.zip.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_aarch64*",".{0,1000}meshagent_aarch64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_aarch64-cortex-a53*",".{0,1000}meshagent_aarch64\-cortex\-a53.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_alpine-x86-64*",".{0,1000}meshagent_alpine\-x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_android.apk*",".{0,1000}meshagent_android\.apk.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_arm*",".{0,1000}meshagent_arm.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_arm64*",".{0,1000}meshagent_arm64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_armhf*",".{0,1000}meshagent_armhf.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_freebsd_x86-64*",".{0,1000}meshagent_freebsd_x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_mips*",".{0,1000}meshagent_mips.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_mips24kc*",".{0,1000}meshagent_mips24kc.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_mipsel24kc*",".{0,1000}meshagent_mipsel24kc.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_openbsd_x86-64*",".{0,1000}meshagent_openbsd_x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_openwrt_x86_64*",".{0,1000}meshagent_openwrt_x86_64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_osx64.msh*",".{0,1000}meshagent_osx64\.msh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_osx64_LaunchDaemon*",".{0,1000}meshagent_osx64_LaunchDaemon.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_osx-arm-64*",".{0,1000}meshagent_osx\-arm\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_osx-universal-64*",".{0,1000}meshagent_osx\-universal\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_osx-x86-32*",".{0,1000}meshagent_osx\-x86\-32.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_osx-x86-64*",".{0,1000}meshagent_osx\-x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_pogo*",".{0,1000}meshagent_pogo.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_poky*",".{0,1000}meshagent_poky.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_poky64*",".{0,1000}meshagent_poky64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_x86*",".{0,1000}meshagent_x86.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent_x86-64*",".{0,1000}meshagent_x86\-64.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent32.exe*",".{0,1000}meshagent32\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagent64.exe*",".{0,1000}meshagent64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgent-Android-x86*",".{0,1000}MeshAgent\-Android\-x86.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshagentarm64.exe*",".{0,1000}meshagentarm64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgent-ChromeOS*",".{0,1000}MeshAgent\-ChromeOS.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgent-Linux-ARM-PlugPC*",".{0,1000}MeshAgent\-Linux\-ARM\-PlugPC.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgent-Linux-XEN-x86-32*",".{0,1000}MeshAgent\-Linux\-XEN\-x86\-32.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgent-NodeJS*",".{0,1000}MeshAgent\-NodeJS.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgentOSXPackager.zip*",".{0,1000}MeshAgentOSXPackager\.zip.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgent-WinMinCore-Console-x86-32.exe*",".{0,1000}MeshAgent\-WinMinCore\-Console\-x86\-32\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshAgent-WinMinCore-Service-x86-64.exe*",".{0,1000}MeshAgent\-WinMinCore\-Service\-x86\-64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*Meshcentral - WebRTC Sample Server*",".{0,1000}Meshcentral\s\-\sWebRTC\sSample\sServer.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*MeshCentral HTTP server port *",".{0,1000}MeshCentral\sHTTP\sserver\sport\s.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentral Satellite could not create a 802.1x profile for this device*",".{0,1000}MeshCentral\sSatellite\scould\snot\screate\sa\s802\.1x\sprofile\sfor\sthis\sdevice.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentral Server TCP ports*",".{0,1000}MeshCentral\sServer\sTCP\sports.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentral Server UDP ports*",".{0,1000}MeshCentral\sServer\sUDP\sports.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcentral.exe*",".{0,1000}meshcentral\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcentral.serverstats*",".{0,1000}meshcentral\.serverstats.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentralAssistant.exe*",".{0,1000}MeshCentralAssistant\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentralInstaller.exe*",".{0,1000}MeshCentralInstaller\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcentralinstaller.exe*",".{0,1000}meshcentralinstaller\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcentral-plugins.db*",".{0,1000}meshcentral\-plugins\.db.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentralRoot-*",".{0,1000}MeshCentralRoot\-.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentralRoot-a*",".{0,1000}MeshCentralRoot\-a.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","#certificate","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentralRouter.exe*",".{0,1000}MeshCentralRouter\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCentralServer.njsproj*",".{0,1000}MeshCentralServer\.njsproj.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcentral-smbios.db*",".{0,1000}meshcentral\-smbios\.db.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshCmd64.exe*",".{0,1000}MeshCmd64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcmdService.run*",".{0,1000}meshcmdService\.run.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*MeshCmd-signed.exe*",".{0,1000}MeshCmd\-signed\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcommander install*",".{0,1000}meshcommander\sinstall.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcommander start*",".{0,1000}meshcommander\sstart.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcommander stop*",".{0,1000}meshcommander\sstop.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshcommander uninstall*",".{0,1000}meshcommander\suninstall.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","0","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshConsole64.exe*",".{0,1000}MeshConsole64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshConsoleARM64.exe*",".{0,1000}MeshConsoleARM64\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshinstall-initd.sh*",".{0,1000}meshinstall\-initd\.sh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*meshinstall-linux.sh*",".{0,1000}meshinstall\-linux\.sh.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*MeshService.exe*",".{0,1000}MeshService\.exe.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*Monitoring & Management Agent by ATERA*",".{0,1000}Monitoring\s\&\sManagement\sAgent\sby\sATERA.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*MRU\RemoteSupport\127.0.0.1.tvc*",".{0,1000}MRU\\RemoteSupport\\127\.0\.0\.1\.tvc.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*msi-installs.swi-rc.com/*",".{0,1000}msi\-installs\.swi\-rc\.com\/.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*name=""RustDesk Service""*",".{0,1000}name\=\""RustDesk\sService\"".{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*namespace Quasar.Client*",".{0,1000}namespace\sQuasar\.Client.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*namespace Quasar.Server*",".{0,1000}namespace\sQuasar\.Server.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*net start RPCPerformanceService*",".{0,1000}net\sstart\sRPCPerformanceService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*net stop tacticalrmm*",".{0,1000}net\sstop\stacticalrmm.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*netsh  advfirewall firewall * rule name=""AweSun*",".{0,1000}netsh\s\sadvfirewall\sfirewall\s.{0,1000}\srule\sname\=\""AweSun.{0,1000}","greyware_tool_keyword","aweray","all-in-one secure remote access control and support solution","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","sun.aweray.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*netsh  advfirewall firewall add rule name=\""Level Agent\""*",".{0,1000}netsh\s\sadvfirewall\sfirewall\sadd\srule\sname\=\\\""Level\sAgent\\\"".{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*netsh advfirewall firewall add rule name=""Radmin Server *",".{0,1000}netsh\sadvfirewall\sfirewall\sadd\srule\sname\=\""Radmin\sServer\s.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport Audio Sample Source Filter*",".{0,1000}NetSupport\sAudio\sSample\sSource\sFilter.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport Bitmap Source Filter*",".{0,1000}NetSupport\sBitmap\sSource\sFilter.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport Manager -- Installation *",".{0,1000}NetSupport\sManager\s\-\-\sInstallation\s.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport Manager (1).msi*",".{0,1000}NetSupport\sManager\s\(1\)\.msi.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport Manager.msi*",".{0,1000}NetSupport\sManager\.msi.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport%20Manager.msi*",".{0,1000}NetSupport\%20Manager\.msi.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*netsupport*\PCISA.exe*",".{0,1000}netsupport.{0,1000}\\PCISA\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*netsupport*\runscrip.exe*",".{0,1000}netsupport.{0,1000}\\runscrip\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*netsupport*\supporttool.exe*",".{0,1000}netsupport.{0,1000}\\supporttool\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport_Client_machine.adml*",".{0,1000}NetSupport_Client_machine\.adml.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*NetSupport_Control_Machine.adml*",".{0,1000}NetSupport_Control_Machine\.adml.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*notifications.*.swi-rc.com*",".{0,1000}notifications\..{0,1000}\.swi\-rc\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*novaPDF11PrinterDriver(x64).msi*",".{0,1000}novaPDF11PrinterDriver\(x64\)\.msi.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*npm install fleetctl*",".{0,1000}npm\sinstall\sfleetctl.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*NSM_Control_Machine.adm*",".{0,1000}NSM_Control_Machine\.adm.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*online.level.io*",".{0,1000}online\.level\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*pcicfgui_client.exe*\Client32.ini*",".{0,1000}pcicfgui_client\.exe.{0,1000}\\Client32\.ini.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorCfg.dll*",".{0,1000}PCMonitorCfg\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorClient.dll*",".{0,1000}PCMonitorClient\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorEng.dll*",".{0,1000}PCMonitorEng\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorManager.exe*",".{0,1000}PCMonitorManager\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorManager.exe*",".{0,1000}PCMonitorManager\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMONITORMANAGER.EXE-*.pf*",".{0,1000}PCMONITORMANAGER\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorSrv.exe*",".{0,1000}PCMonitorSrv\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorSrv.exe*",".{0,1000}PCMonitorSrv\.exe.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMONITORSRV.EXE-*.pf*",".{0,1000}PCMONITORSRV\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorSrv.InstallState*",".{0,1000}PCMonitorSrv\.InstallState.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMonitorTypes.dll*",".{0,1000}PCMonitorTypes\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*pcmontask.exe *",".{0,1000}pcmontask\.exe\s.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PCMONTASK.EXE-*.pf*",".{0,1000}PCMONTASK\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*pcmrdp-client.dll*",".{0,1000}pcmrdp\-client\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ping -n 10 localhost > nul*",".{0,1000}ping\s\-n\s10\slocalhost\s\>\snul.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*PollServer poll.gotomypc.com*",".{0,1000}PollServer\spoll\.gotomypc\.com.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*powershell.exe -ExecutionPolicy Bypass -File cleanup_windows.ps1 -uninstallOrbit*",".{0,1000}powershell\.exe\s\-ExecutionPolicy\sBypass\s\-File\scleanup_windows\.ps1\s\-uninstallOrbit.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*proceed: *.fleetdeck.io*",".{0,1000}proceed\:\s.{0,1000}\.fleetdeck\.io.{0,1000}","greyware_tool_keyword","fleetdm","Manage everything in one place","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/fleetdm/fleet","1","0","N/A","N/A","10","10","3183","437","2024-12-08T00:28:45Z","2020-11-03T22:17:18Z"
"*product: damewareagent --*",".{0,1000}product\:\sdamewareagent\s\-\-.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ProductName:Zoho%%20Assist* apptype:ATTENDEE*",".{0,1000}ProductName\:Zoho\%\%20Assist.{0,1000}\sapptype\:ATTENDEE.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files (x86)\Anyplace Control*",".{0,1000}Program\sFiles\s\(x86\)\\Anyplace\sControl.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files (x86)\AnyViewer*",".{0,1000}Program\sFiles\s\(x86\)\\AnyViewer.{0,1000}","greyware_tool_keyword","anyviewer","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyviewer.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files (x86)\Common Files\Two Pilots*",".{0,1000}Program\sFiles\s\(x86\)\\Common\sFiles\\Two\sPilots.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files (x86)\Radmin Viewer 3\*",".{0,1000}Program\sFiles\s\(x86\)\\Radmin\sViewer\s3\\.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*program files (x86)\remotepc\*",".{0,1000}program\sfiles\s\(x86\)\\remotepc\\.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files (x86)\ScreenConnect Client*",".{0,1000}Program\sFiles\s\(x86\)\\ScreenConnect\sClient.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files (x86)\Splashtop*",".{0,1000}Program\sFiles\s\(x86\)\\Splashtop.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*program files (x86)\tightvnc\*",".{0,1000}program\sfiles\s\(x86\)\\tightvnc\\.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files (x86)\uvnc bvba\*",".{0,1000}Program\sFiles\s\(x86\)\\uvnc\sbvba\\.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*program files (x86)\zohomeeting*",".{0,1000}program\sfiles\s\(x86\)\\zohomeeting.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*program files*\netsupport\*",".{0,1000}program\sfiles.{0,1000}\\netsupport\\.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files\DWAgent*",".{0,1000}Program\sFiles\\DWAgent.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","0","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*Program Files\Level\level.log*",".{0,1000}Program\sFiles\\Level\\level\.log.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files\SimpleHelp*",".{0,1000}Program\sFiles\\SimpleHelp.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Program Files\VSA X\*",".{0,1000}Program\sFiles\\VSA\sX\\.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ProgramData\JWrapper-Remote Access\*.exe*",".{0,1000}ProgramData\\JWrapper\-Remote\sAccess\\.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ProgramData\JWrapper-Remote Access\*.exe*",".{0,1000}ProgramData\\JWrapper\-Remote\sAccess\\.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","vncviewer","SimpleHelp or VNCViewer is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","simple-help.com","1","0","N/A","could be used by VNCViewer or SimpleHelp","10","10","N/A","N/A","N/A","N/A"
"*ProgramData\Kaseya\*",".{0,1000}ProgramData\\Kaseya\\.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ProgramData\RemotePC Performance*",".{0,1000}ProgramData\\RemotePC\sPerformance.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ProgramData\RemotePC*",".{0,1000}ProgramData\\RemotePC.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ProgramData\TightVNC*",".{0,1000}ProgramData\\TightVNC.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ProgramFiles(x86)\xeox\*",".{0,1000}ProgramFiles\(x86\)\\xeox\\.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ProgramFiles\xeox\*",".{0,1000}ProgramFiles\\xeox\\.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*provider name=""n-able take control - [dameware]"" />*",".{0,1000}provider\sname\=\""n\-able\stake\scontrol\s\-\s\[dameware\]\""\s\/\>.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*PUA:Win32/AmmyyAdmin*",".{0,1000}PUA\:Win32\/AmmyyAdmin.{0,1000}","signature_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*PUA:Win32/AmmyyAdmin*",".{0,1000}PUA\:Win32\/AmmyyAdmin.{0,1000}","signature_keyword","Ammyy Admin","Antiviurs signature_keyword","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","N/A","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*Pulseway -- Installation completed successfully*",".{0,1000}Pulseway\s\-\-\sInstallation\scompleted\ssuccessfully.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Pulseway -- Removal completed successfully*",".{0,1000}Pulseway\s\-\-\sRemoval\scompleted\ssuccessfully.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Pulseway Remote Control -- Installation completed successfully*",".{0,1000}Pulseway\sRemote\sControl\s\-\-\sInstallation\scompleted\ssuccessfully.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Pulseway Remote Control.lnk*",".{0,1000}Pulseway\sRemote\sControl\.lnk.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*pulseway_x64.pkg.tar.xz*",".{0,1000}pulseway_x64\.pkg\.tar\.xz.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*pwyrc-clip.exe*",".{0,1000}pwyrc\-clip\.exe.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Quasar Client Startup*",".{0,1000}Quasar\sClient\sStartup.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar v*\Client-built.exe*",".{0,1000}Quasar\sv.{0,1000}\\Client\-built\.exe.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.Client.*",".{0,1000}Quasar\.Client\..{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.Common.Tests\*",".{0,1000}Quasar\.Common\.Tests\\.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.exe*",".{0,1000}Quasar\.exe.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.Server*",".{0,1000}Quasar\.Server.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.Server\Program.cs*",".{0,1000}Quasar\.Server\\Program\.cs.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.sln*",".{0,1000}Quasar\.sln.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar.v1.4.1.zip*",".{0,1000}Quasar\.v1\.4\.1\.zip.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*quasar/Quasar*",".{0,1000}quasar\/Quasar.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Quasar-master.zip*",".{0,1000}Quasar\-master\.zip.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*QuasarRAT*",".{0,1000}QuasarRAT.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","1","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*QuickAssist.exe launched*",".{0,1000}QuickAssist\.exe\slaunched.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*radmin /connect:*",".{0,1000}radmin\s\/connect\:.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Radmin Server V3*",".{0,1000}Radmin\sServer\sV3.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","ServiceName","10","10","N/A","N/A","N/A","N/A"
"*Radmin Viewer 3\CHATLOGS\*",".{0,1000}Radmin\sViewer\s3\\CHATLOGS\\.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Radmin Viewer 3\rchatx.dll*",".{0,1000}Radmin\sViewer\s3\\rchatx\.dll.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*radmin.exe* /connect:*",".{0,1000}radmin\.exe.{0,1000}\s\/connect\:.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-asia-au-1.pulseway.com*",".{0,1000}rd\-asia\-au\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-eu-de-1.pulseway.com*",".{0,1000}rd\-eu\-de\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-eu-ie-1.pulseway.com*",".{0,1000}rd\-eu\-ie\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-us-east-1.pulseway.com*",".{0,1000}rd\-us\-east\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-us-east-2.pulseway.com*",".{0,1000}rd\-us\-east\-2\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rd-us-west-1.pulseway.com*",".{0,1000}rd\-us\-west\-1\.pulseway\.com.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*realtime.ably.io*",".{0,1000}realtime\.ably\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RealVNC.VNCViewer*",".{0,1000}RealVNC\.VNCViewer.{0,1000}","greyware_tool_keyword","vncviewer","VNCViewer is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","N/A","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Received Request Run PowerShell command '*' from device Id*",".{0,1000}Received\sRequest\sRun\sPowerShell\scommand\s\'.{0,1000}\'\sfrom\sdevice\sId.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*REG DELETE ""HKEY_CLASSES_ROOT\Installer\Products\10F15BFE50893924BB61F671FEC4D2EF"" /f*",".{0,1000}REG\sDELETE\s\""HKEY_CLASSES_ROOT\\Installer\\Products\\10F15BFE50893924BB61F671FEC4D2EF\""\s\/f.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/#c01","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*REG DELETE ""HKEY_CLASSES_ROOT\Installer\Products\4758948C95C1B194AB15204D95B42292"" /f*",".{0,1000}REG\sDELETE\s\""HKEY_CLASSES_ROOT\\Installer\\Products\\4758948C95C1B194AB15204D95B42292\""\s\/f.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/#c01","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*relay-*.net.anydesk.com*",".{0,1000}relay\-.{0,1000}\.net\.anydesk\.com.{0,1000}","greyware_tool_keyword","anydesk","Anydesk RMM usage","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","BlackSuit - Royal - Akira - BlackCat - Karakurt - LockBit - Rhysida - AvosLocker - Conti - Dagon Locker - Nokoyawa - Quantum - Diavol - Trigona - BlackByte - Cactus - Lapsus$ - Black Basta - MONTI - Karakurt - Dispossessor","RMM","https://anydesk.com/","1","1","N/A","risk of false positives - compliance detection","10","10","N/A","N/A","N/A","N/A"
"*-relay.screenconnect.com*",".{0,1000}\-relay\.screenconnect\.com.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote AccessECompatibility.exe*",".{0,1000}Remote\sAccessECompatibility\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux32arm-offline.tar*",".{0,1000}Remote\sAccess\-linux32arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux32arm-online.tar*",".{0,1000}Remote\sAccess\-linux32arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux32-offline.tar*",".{0,1000}Remote\sAccess\-linux32\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux32-online.tar*",".{0,1000}Remote\sAccess\-linux32\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux64arm-offline.tar*",".{0,1000}Remote\sAccess\-linux64arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux64arm-online.tar*",".{0,1000}Remote\sAccess\-linux64arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux64-offline.tar*",".{0,1000}Remote\sAccess\-linux64\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-linux64-online.tar*",".{0,1000}Remote\sAccess\-linux64\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-macos-intel-offline.dmg*",".{0,1000}Remote\sAccess\-macos\-intel\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-macos-intel-online.dmg*",".{0,1000}Remote\sAccess\-macos\-intel\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-macos-offline.dmg*",".{0,1000}Remote\sAccess\-macos\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-macos-online.dmg*",".{0,1000}Remote\sAccess\-macos\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-windows32-offline.exe*",".{0,1000}Remote\sAccess\-windows32\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-windows32-online.exe*",".{0,1000}Remote\sAccess\-windows32\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-windows64-offline.exe*",".{0,1000}Remote\sAccess\-windows64\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remote access-windows64-online.exe*",".{0,1000}remote\saccess\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Access-windows64-online.exe*",".{0,1000}Remote\sAccess\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-java-online.jar*",".{0,1000}Remote\sSupport\-java\-online\.jar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux32arm-offline.tar*",".{0,1000}Remote\sSupport\-linux32arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux32arm-online.tar*",".{0,1000}Remote\sSupport\-linux32arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux32-offline.tar*",".{0,1000}Remote\sSupport\-linux32\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux32-online.tar*",".{0,1000}Remote\sSupport\-linux32\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux64arm-offline.tar*",".{0,1000}Remote\sSupport\-linux64arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux64arm-online.tar*",".{0,1000}Remote\sSupport\-linux64arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux64-offline.tar*",".{0,1000}Remote\sSupport\-linux64\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-linux64-online.tar*",".{0,1000}Remote\sSupport\-linux64\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-macos-intel-offline.dmg*",".{0,1000}Remote\sSupport\-macos\-intel\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-macos-intel-online.dmg*",".{0,1000}Remote\sSupport\-macos\-intel\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-macos-offline.dmg*",".{0,1000}Remote\sSupport\-macos\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-macos-online.dmg*",".{0,1000}Remote\sSupport\-macos\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-windows32-offline.exe*",".{0,1000}Remote\sSupport\-windows32\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-windows32-online.exe*",".{0,1000}Remote\sSupport\-windows32\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-windows64-offline.exe*",".{0,1000}Remote\sSupport\-windows64\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remote support-windows64-online.exe*",".{0,1000}remote\ssupport\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Support-windows64-online.exe*",".{0,1000}Remote\sSupport\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Utilities Pty (Cy) Ltd.*",".{0,1000}Remote\sUtilities\sPty\s\(Cy\)\sLtd\..{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remote work-windows64-online.exe*",".{0,1000}remote\swork\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Remote Work-windows64-online.exe*",".{0,1000}Remote\sWork\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteAccess:Win32/AmmyAdmin*",".{0,1000}RemoteAccess\:Win32\/AmmyAdmin.{0,1000}","signature_keyword","Ammyy Admin","Antiviurs signature_keyword","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteAccess:Win32/AnyplaceControl*",".{0,1000}RemoteAccess\:Win32\/AnyplaceControl.{0,1000}","signature_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteAccess:Win32/DameWareMiniRemoteControl.B*",".{0,1000}RemoteAccess\:Win32\/DameWareMiniRemoteControl\.B.{0,1000}","signature_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*RemoteAccess:Win32/TightVNC*",".{0,1000}RemoteAccess\:Win32\/TightVNC.{0,1000}","signature_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteAccess:Win32/UltraVNC*",".{0,1000}RemoteAccess\:Win32\/UltraVNC.{0,1000}","signature_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteAdmin.RemoteUtilities*",".{0,1000}RemoteAdmin\.RemoteUtilities.{0,1000}","signature_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteAdmin.RemoteUtilities*",".{0,1000}RemoteAdmin\.RemoteUtilities.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteDesktop.exe *",".{0,1000}RemoteDesktop\.exe\s.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteDesktop.exe*pwy-rd:?token=*",".{0,1000}RemoteDesktop\.exe.{0,1000}pwy\-rd\:\?token\=.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remotedesktop.google.com/access*",".{0,1000}remotedesktop\.google\.com\/access.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remotedesktop.google.com/support*",".{0,1000}remotedesktop\.google\.com\/support.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteDesktop_x64 (1).msi*",".{0,1000}RemoteDesktop_x64\s\(1\)\.msi.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemoteDesktop_x64.msi*",".{0,1000}RemoteDesktop_x64\.msi.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePC (1).exe*",".{0,1000}RemotePC\s\(1\)\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePC Performance Printer.url*",".{0,1000}RemotePC\sPerformance\sPrinter\.url.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePC* - A new computer has been added to your account*",".{0,1000}RemotePC.{0,1000}\s\-\sA\snew\scomputer\shas\sbeen\sadded\sto\syour\saccount.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePC.exe *",".{0,1000}RemotePC\.exe\s.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePC.WebSockets.dll*",".{0,1000}RemotePC\.WebSockets\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePC\REMOTE~2.DLL*",".{0,1000}RemotePC\\REMOTE\~2\.DLL.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCAttended.exe*",".{0,1000}RemotePCAttended\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCAttendedService*",".{0,1000}RemotePCAttendedService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCBlackScreenApp.exe*",".{0,1000}RemotePCBlackScreenApp\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCCopyPaste.txt*",".{0,1000}RemotePCCopyPaste\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCDesktop.exe*",".{0,1000}RemotePCDesktop\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCDesktop.txt*",".{0,1000}RemotePCDesktop\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCHDDesktop.txt*",".{0,1000}RemotePCHDDesktop\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCHDService.txt*",".{0,1000}RemotePCHDService\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remotepclauncher.exe *",".{0,1000}remotepclauncher\.exe\s.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCModules.log*",".{0,1000}RemotePCModules\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCPerformanceWebLauncher.exe*",".{0,1000}RemotePCPerformanceWebLauncher\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCPerformanceWebLauncher.log*",".{0,1000}RemotePCPerformanceWebLauncher\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCPrinter.exe.config*",".{0,1000}RemotePCPrinter\.exe\.config.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCPrinting.exe*",".{0,1000}RemotePCPrinting\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCPrintView.exe*",".{0,1000}RemotePCPrintView\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCProxys.dat*",".{0,1000}RemotePCProxys\.dat.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCService.exe*",".{0,1000}RemotePCService\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCService.txt*",".{0,1000}RemotePCService\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCService_2.txt*",".{0,1000}RemotePCService_2\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCShortcut.exe*",".{0,1000}RemotePCShortcut\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCSuite.Model.dll*",".{0,1000}RemotePCSuite\.Model\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RemotePCSuite.Service.dll*",".{0,1000}RemotePCSuite\.Service\.dll.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*remotepcuiu.exe *",".{0,1000}remotepcuiu\.exe\s.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rest.ably.io*",".{0,1000}rest\.ably\.io.{0,1000}","greyware_tool_keyword","level.io","Level is reinventing remote monitoring and management","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://level.io/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rfusclient.exe *",".{0,1000}rfusclient\.exe\s.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rl.ammyy.com/*",".{0,1000}rl\.ammyy\.com\/.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rmm.barracudamsp.com*",".{0,1000}rmm\.barracudamsp\.com.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RMM.WebRemote.exe*",".{0,1000}RMM\.WebRemote\.exe.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*rootcert.meshcentral.com*",".{0,1000}rootcert\.meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*RpcApp*TransferClient.exe*",".{0,1000}RpcApp.{0,1000}TransferClient\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RpcApp*TransferServer.exe*",".{0,1000}RpcApp.{0,1000}TransferServer\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RpcApp\Tools\TransferClient.exe*",".{0,1000}RpcApp\\Tools\\TransferClient\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCAttendedInstaller.log*",".{0,1000}RPCAttendedInstaller\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rpcdownloader.exe *",".{0,1000}rpcdownloader\.exe\s.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCDownloaderLogFile.txt*",".{0,1000}RPCDownloaderLogFile\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCFireWallRule.exe*",".{0,1000}RPCFireWallRule\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCFireWallRulelogfile.txt*",".{0,1000}RPCFireWallRulelogfile\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCKeyMouseHandler.txt*",".{0,1000}RPCKeyMouseHandler\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCPerformanceHealthCheck*",".{0,1000}RPCPerformanceHealthCheck.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rpcperformanceservice.exe*",".{0,1000}rpcperformanceservice\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCPerformanceService.exe*",".{0,1000}RPCPerformanceService\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rpcperfviewer.exe *",".{0,1000}rpcperfviewer\.exe\s.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCPerfViewer.log*",".{0,1000}RPCPerfViewer\.log.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rpcprinterdownloader.exe*",".{0,1000}rpcprinterdownloader\.exe.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCProxyLatency.exe *",".{0,1000}RPCProxyLatency\.exe\s.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*RPCsuiteLaunch.txt*",".{0,1000}RPCsuiteLaunch\.txt.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rserver3 /start*",".{0,1000}rserver3\s\/start.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rserver3 /stop*",".{0,1000}rserver3\s\/stop.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rserver3.exe*/start*",".{0,1000}rserver3\.exe.{0,1000}\/start.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rserver3.exe*/stop*",".{0,1000}rserver3\.exe.{0,1000}\/stop.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rs-ny.rustdesk.com*",".{0,1000}rs\-ny\.rustdesk\.com.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","network request after installation","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rule name=""TransferServer""*",".{0,1000}rule\sname\=\""TransferServer\"".{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Client<*",".{0,1000}\'RuleName\'\>NetSupport\sClient\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Control<*",".{0,1000}\'RuleName\'\>NetSupport\sControl\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Deploy<*",".{0,1000}\'RuleName\'\>NetSupport\sDeploy\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Gateway<*",".{0,1000}\'RuleName\'\>NetSupport\sGateway\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Group Leader<*",".{0,1000}\'RuleName\'\>NetSupport\sGroup\sLeader\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Run Script<*",".{0,1000}\'RuleName\'\>NetSupport\sRun\sScript\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Script Editor<*",".{0,1000}\'RuleName\'\>NetSupport\sScript\sEditor\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Scripting Agent<*",".{0,1000}\'RuleName\'\>NetSupport\sScripting\sAgent\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Tech Console<*",".{0,1000}\'RuleName\'\>NetSupport\sTech\sConsole\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*'RuleName'>NetSupport Tutor<*",".{0,1000}\'RuleName\'\>NetSupport\sTutor\<.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","#firewallrulename","N/A","10","10","N/A","N/A","N/A","N/A"
"*RuntimeBroker_rustdesk.exe*",".{0,1000}RuntimeBroker_rustdesk\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RustDesk Service is running*",".{0,1000}RustDesk\sService\sis\srunning.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rustdesk-*.apk*",".{0,1000}rustdesk\-.{0,1000}\.apk.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rustdesk-*.deb*",".{0,1000}rustdesk\-.{0,1000}\.deb.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rustdesk-*.dmg*",".{0,1000}rustdesk\-.{0,1000}\.dmg.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rustdesk-*.rpm*",".{0,1000}rustdesk\-.{0,1000}\.rpm.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rustdesk-*-win7-install.exe*",".{0,1000}rustdesk\-.{0,1000}\-win7\-install\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RustDesk.exe *",".{0,1000}RustDesk\.exe\s.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RUSTDESK.EXE-*.pf*",".{0,1000}RUSTDESK\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RustDesk_hwcodec.*",".{0,1000}RustDesk_hwcodec\..{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RustDesk_install.bat*",".{0,1000}RustDesk_install\.bat.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rustdesk_portable.exe*",".{0,1000}rustdesk_portable\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RustDesk_rCURRENT.log*",".{0,1000}RustDesk_rCURRENT\.log.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RustDesk_uninstall.bat*",".{0,1000}RustDesk_uninstall\.bat.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RustDeskIddDriver.cer*",".{0,1000}RustDeskIddDriver\.cer.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*RustDeskIddDriver.dll*",".{0,1000}RustDeskIddDriver\.dll.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rustdesk-portable-packer.exe*",".{0,1000}rustdesk\-portable\-packer\.exe.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","1","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*rutserv.exe *",".{0,1000}rutserv\.exe\s.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rutserv.exe /*",".{0,1000}rutserv\.exe\s\/.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rutview.exe *",".{0,1000}rutview\.exe\s.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*rutview.exe -*",".{0,1000}rutview\.exe\s\-.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc  delete ""RPCService""*",".{0,1000}sc\s\sdelete\s\""RPCService\"".{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SC  QUERYEX ""PC Monitor""*",".{0,1000}SC\s\sQUERYEX\s\""PC\sMonitor\"".{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SC  QUERYEX ""PC Monitor""*",".{0,1000}SC\s\sQUERYEX\s\""PC\sMonitor\"".{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SC  QUERYEX ""VSAX""*",".{0,1000}SC\s\sQUERYEX\s\""VSAX\"".{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc  start ""RPCService""*",".{0,1000}sc\s\sstart\s\""RPCService\"".{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc  stop ""RPCService""*",".{0,1000}sc\s\sstop\s\""RPCService\"".{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc create RPCService start=auto*",".{0,1000}sc\screate\sRPCService\sstart\=auto.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc create RPCService*",".{0,1000}sc\screate\sRPCService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc delete ""RPCService""*",".{0,1000}sc\sdelete\s\""RPCService\"".{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc delete AteraAgent*",".{0,1000}sc\sdelete\sAteraAgent.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc delete ViewerService*",".{0,1000}sc\sdelete\sViewerService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc start AteraAgent*",".{0,1000}sc\sstart\sAteraAgent.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc start RustDesk*",".{0,1000}sc\sstart\sRustDesk.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*sc start ViewerService*",".{0,1000}sc\sstart\sViewerService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc stop ""RPCService""*",".{0,1000}sc\sstop\s\""RPCService\"".{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc stop AteraAgent*",".{0,1000}sc\sstop\sAteraAgent.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*sc stop RustDesk*",".{0,1000}sc\sstop\sRustDesk.{0,1000}","greyware_tool_keyword","RustDesk","Rustdesk open suorce remote control software abused by scammers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","Akira - Scattered Spider*","RMM","https://github.com/rustdesk/rustdesk","1","0","N/A","N/A","10","10","77219","10497","2024-12-07T14:34:54Z","2020-09-28T15:36:08Z"
"*sc stop ViewerService*",".{0,1000}sc\sstop\sViewerService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect Software*",".{0,1000}ScreenConnect\sSoftware.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.Client.dll*",".{0,1000}ScreenConnect\.Client\.dll.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.Client.exe.jar*",".{0,1000}ScreenConnect\.Client\.exe\.jar.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.ClientService.dll*",".{0,1000}ScreenConnect\.ClientService\.dll.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.ClientService.exe*",".{0,1000}ScreenConnect\.ClientService\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.ClientSetup.exe*",".{0,1000}ScreenConnect\.ClientSetup\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SCREENCONNECT.CLIENTSETUP.EXE-*.pf*",".{0,1000}SCREENCONNECT\.CLIENTSETUP\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.ClientUninstall.vbs*",".{0,1000}ScreenConnect\.ClientUninstall\.vbs.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.Core.pdb*",".{0,1000}ScreenConnect\.Core\.pdb.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.Server.dll*",".{0,1000}ScreenConnect\.Server\.dll.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.Service.exe*",".{0,1000}ScreenConnect\.Service\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SCREENCONNECT.SERVICE.EXE-*.pf*",".{0,1000}SCREENCONNECT\.SERVICE\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.WindowsBackstageShell.exe*",".{0,1000}ScreenConnect\.WindowsBackstageShell\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SCREENCONNECT.WINDOWSCLIENT.*.pf*",".{0,1000}SCREENCONNECT\.WINDOWSCLIENT\..{0,1000}\.pf.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.WindowsClient.exe*",".{0,1000}ScreenConnect\.WindowsClient\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect.WindowsInstaller.dll*",".{0,1000}ScreenConnect\.WindowsInstaller\.dll.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect_*_Release.msi*",".{0,1000}ScreenConnect_.{0,1000}_Release\.msi.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect_*_Release.tar.gz*",".{0,1000}ScreenConnect_.{0,1000}_Release\.tar\.gz.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnect_*_Release.zip*",".{0,1000}ScreenConnect_.{0,1000}_Release\.zip.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ScreenConnectClientNetworkDeployer.exe*",".{0,1000}ScreenConnectClientNetworkDeployer\.exe.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*server*-relay.screenconnect.com*",".{0,1000}server.{0,1000}\-relay\.screenconnect\.com.{0,1000}","greyware_tool_keyword","ScreenConnect","control remote servers - abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","screenconnect.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*server.action1.com*",".{0,1000}server\.action1\.com.{0,1000}","greyware_tool_keyword","action1","Action1 remote administration tool abused buy attacker","T1021 - T1071 - T1090","TA0008 - TA0011","N/A","LockBit - MONTI","RMM","https://app.action1.com/","1","1","#dnsquery","dns request","10","10","N/A","N/A","N/A","N/A"
"*server.remoteutilities.com*",".{0,1000}server\.remoteutilities\.com.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*serverinfo.alpemix.com*",".{0,1000}serverinfo\.alpemix\.com.{0,1000}","greyware_tool_keyword","Alpemix","connect to your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.alpemix.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*service pulseway start*",".{0,1000}service\spulseway\sstart.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*service pulseway stop*",".{0,1000}service\spulseway\sstop.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ServiceName"">Pulseway</Data>*",".{0,1000}ServiceName\""\>Pulseway\<\/Data\>.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ServiceName'>GoToMyPC*",".{0,1000}ServiceName\'\>GoToMyPC.{0,1000}","greyware_tool_keyword","GoToMyPC","GoToMyPC is remote desktop software that allows users to access computers remotely using a web browser","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","N/A","RMM","https://www.gotomypc.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'ServiceName'>VSA X</Data>*",".{0,1000}\'ServiceName\'\>VSA\sX\<\/Data\>.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'ServiceName'>VSAX</Data>*",".{0,1000}\'ServiceName\'\>VSAX\<\/Data\>.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'ServiceName'>Zoho Assist-Remote Support*",".{0,1000}\'ServiceName\'\>Zoho\sAssist\-Remote\sSupport.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Settings for Radmin Server.lnk*",".{0,1000}Settings\sfor\sRadmin\sServer\.lnk.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp - simple-help.com*",".{0,1000}SimpleHelp\s\-\ssimple\-help\.com.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp remote work.exe*",".{0,1000}simplehelp\sremote\swork\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp remote workwinlauncher.exe*",".{0,1000}simplehelp\sremote\sworkwinlauncher\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Remote WorkWinLauncher.exe*",".{0,1000}SimpleHelp\sRemote\sWorkWinLauncher\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician.exe*",".{0,1000}SimpleHelp\sTechnician\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp technician.exe*",".{0,1000}simplehelp\stechnician\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-java-online.jar*",".{0,1000}SimpleHelp\sTechnician\-java\-online\.jar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux32arm-offline.tar*",".{0,1000}SimpleHelp\sTechnician\-linux32arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux32arm-online.tar*",".{0,1000}SimpleHelp\sTechnician\-linux32arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux32-offline.tar*",".{0,1000}SimpleHelp\sTechnician\-linux32\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux32-online.tar*",".{0,1000}SimpleHelp\sTechnician\-linux32\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux64arm-offline.tar*",".{0,1000}SimpleHelp\sTechnician\-linux64arm\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux64arm-online.tar*",".{0,1000}SimpleHelp\sTechnician\-linux64arm\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux64-offline.tar*",".{0,1000}SimpleHelp\sTechnician\-linux64\-offline\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-linux64-online.tar*",".{0,1000}SimpleHelp\sTechnician\-linux64\-online\.tar.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-macos-intel-offline.dmg*",".{0,1000}SimpleHelp\sTechnician\-macos\-intel\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-macos-intel-online.dmg*",".{0,1000}SimpleHelp\sTechnician\-macos\-intel\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-macos-offline.dmg*",".{0,1000}SimpleHelp\sTechnician\-macos\-offline\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-macos-online.dmg*",".{0,1000}SimpleHelp\sTechnician\-macos\-online\.dmg.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-windows32-offline.exe*",".{0,1000}SimpleHelp\sTechnician\-windows32\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-windows32-online.exe*",".{0,1000}SimpleHelp\sTechnician\-windows32\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-windows64-offline.exe*",".{0,1000}SimpleHelp\sTechnician\-windows64\-offline\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp technician-windows64-online.exe*",".{0,1000}simplehelp\stechnician\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp Technician-windows64-online.exe*",".{0,1000}SimpleHelp\sTechnician\-windows64\-online\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp technicianwinlauncher.exe*",".{0,1000}simplehelp\stechnicianwinlauncher\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp.exe*",".{0,1000}SimpleHelp\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelp.technician.127_0_0_1*",".{0,1000}simplehelp\.technician\.127_0_0_1.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp-allplatforms.zip*",".{0,1000}SimpleHelp\-allplatforms\.zip.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*simplehelpcustomer.exe*",".{0,1000}simplehelpcustomer\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SimpleHelp-install-64.exe*",".{0,1000}SimpleHelp\-install\-64\.exe.{0,1000}","greyware_tool_keyword","SimpleHelp","SimpleHelp is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackCat","RMM","simple-help.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*--single-argument https://www.solarwinds.com/*/remote-support-software*",".{0,1000}\-\-single\-argument\shttps\:\/\/www\.solarwinds\.com\/.{0,1000}\/remote\-support\-software.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*SOFTWARE\ATERA Networks\AlphaAgent*",".{0,1000}SOFTWARE\\ATERA\sNetworks\\AlphaAgent.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*SOFTWARE\Microsoft\QuickAssist*",".{0,1000}SOFTWARE\\Microsoft\\QuickAssist.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","#registry","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*Software\Splashtop Inc.\Splashtop*",".{0,1000}Software\\Splashtop\sInc\.\\Splashtop.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","0","#registry","N/A","10","10","N/A","N/A","N/A","N/A"
"*SOFTWARE\TacticalRMM*",".{0,1000}SOFTWARE\\TacticalRMM.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","#registry","registry","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*SolarWinds.MRC.Licensor*",".{0,1000}SolarWinds\.MRC\.Licensor.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds.Orion.MaintDateCheck*",".{0,1000}SolarWinds\.Orion\.MaintDateCheck.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","0","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-DRS-St.exe*",".{0,1000}SolarWinds\-Dameware\-DRS\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-DRS-St-Eval.zip*",".{0,1000}SolarWinds\-Dameware\-DRS\-St\-Eval\.zip.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","Dameware Remote Support","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-MRC-32bit-St.exe*",".{0,1000}SolarWinds\-Dameware\-MRC\-32bit\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-MRC-32bit-St-Eval.zip*",".{0,1000}SolarWinds\-Dameware\-MRC\-32bit\-St\-Eval\.zip.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-MRC-64bit-St.exe*",".{0,1000}SolarWinds\-Dameware\-MRC\-64bit\-St\.exe.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*SolarWinds-Dameware-MRC-64bit-St-Eval.zip*",".{0,1000}SolarWinds\-Dameware\-MRC\-64bit\-St\-Eval\.zip.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Mini Remote Control tool ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/dameware-mini-remote-control","1","1","N/A","Dameware Mini Remote Control","10","10","N/A","N/A","N/A","N/A"
"*Splashtop Remote\Server\log\agent_log.txt*",".{0,1000}Splashtop\sRemote\\Server\\log\\agent_log\.txt.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Splashtop Remote\Server\log\SPLog.txt*",".{0,1000}Splashtop\sRemote\\Server\\log\\SPLog\.txt.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Splashtop Remote\Server\log\svcinfo.txt*",".{0,1000}Splashtop\sRemote\\Server\\log\\svcinfo\.txt.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Splashtop Remote\Server\log\sysinfo.txt*",".{0,1000}Splashtop\sRemote\\Server\\log\\sysinfo\.txt.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Splashtop_Streamer_Windows_*.exe*",".{0,1000}Splashtop_Streamer_Windows_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Splashtop-Splashtop Streamer-*",".{0,1000}Splashtop\-Splashtop\sStreamer\-.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SplashtopStreamer.*.exe*",".{0,1000}SplashtopStreamer\..{0,1000}\.exe.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://ruler-project.github.io/ruler-project/RULER/remote/Splashtop/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SplashtopStreamer3500.exe* prevercheck *",".{0,1000}SplashtopStreamer3500\.exe.{0,1000}\sprevercheck\s.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://thedfirreport.com/2023/09/25/from-screenconnect-to-hive-ransomware-in-61-hours/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SPR/Ammyy.R*",".{0,1000}SPR\/Ammyy\.R.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*SPR/Ammyy.R*",".{0,1000}SPR\/Ammyy\.R.{0,1000}","signature_keyword","Ammyy Admin","Antiviurs signature_keyword","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*Starting HVNC Server*",".{0,1000}Starting\sHVNC\sServer.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","#content","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*StartRPCPerformanceService*",".{0,1000}StartRPCPerformanceService.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*StartRPCPerformanceServiceOnStart*",".{0,1000}StartRPCPerformanceServiceOnStart.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*static.remotepc.com*",".{0,1000}static\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*stop dameware remote everywhere agent.lnk*",".{0,1000}stop\sdameware\sremote\severywhere\sagent\.lnk.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Stop Radmin Server.lnk*",".{0,1000}Stop\sRadmin\sServer\.lnk.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Stop-Process -Force -Name remote_assistance_host*",".{0,1000}Stop\-Process\s\-Force\s\-Name\sremote_assistance_host.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","#windows","N/A","10","10","N/A","N/A","N/A","N/A"
"*Stop-Process -Force -Name remote_assistance_host_uiaccess*",".{0,1000}Stop\-Process\s\-Force\s\-Name\sremote_assistance_host_uiaccess.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","#windows","N/A","10","10","N/A","N/A","N/A","N/A"
"*Stop-Process -Force -Name remoting_native_messaging_host*",".{0,1000}Stop\-Process\s\-Force\s\-Name\sremoting_native_messaging_host.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","#windows","N/A","10","10","N/A","N/A","N/A","N/A"
"*su - tactical*",".{0,1000}su\s\-\stactical.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*su ehorus -s /bin/bash -c ""kill -9 -1""*",".{0,1000}su\sehorus\s\-s\s\/bin\/bash\s\-c\s\""kill\s\-9\s\-1\"".{0,1000}","greyware_tool_keyword","EHORUS RMM","Pandora RC (formerly called eHorus) is a computer management system for MS Windows - Linux and MacOS that allows access to registered computers wherever they are from a browser without direct connectivity to their devices from the outside. (server based on VNC)","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Blacksuit - Royal","RMM","https://pandorafms.com/en/remote-control/","1","0","#linux","N/A","10","10","N/A","N/A","N/A","N/A"
"*sudo -s /bin/bash tactical*",".{0,1000}sudo\s\-s\s\/bin\/bash\stactical.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","#linux","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*support.radmin.com*",".{0,1000}support\.radmin\.com.{0,1000}","greyware_tool_keyword","Radmin","Radmin is a remote control program that lets you work on another computer through your own","T1021 - T1076 - T1563","TA0008 - TA0009 - TA0002","N/A","Akira","RMM","https://www.radmin.com/download/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Support-LogMeInRescue.exe*",".{0,1000}Support\-LogMeInRescue\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Support-LogMeInRescue.exe*",".{0,1000}Support\-LogMeInRescue\.exe.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SUPPORT-LOGMEINRESCUE.EXE-*",".{0,1000}SUPPORT\-LOGMEINRESCUE\.EXE\-.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*supremo remote control*",".{0,1000}supremo\sremote\scontrol.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","#registry","registry value","10","10","N/A","N/A","N/A","N/A"
"*Supremo.00.Client.log*",".{0,1000}Supremo\.00\.Client\.log.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Supremo.00.FileTransfer.log*",".{0,1000}Supremo\.00\.FileTransfer\.log.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Supremo.exe *",".{0,1000}Supremo\.exe\s.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*supremogw*.nanosystems.it*",".{0,1000}supremogw.{0,1000}\.nanosystems\.it.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","agent network connection ","10","10","N/A","N/A","N/A","N/A"
"*supremohelper.exe*",".{0,1000}supremohelper\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SupremoRemoteDesktop\History.txt*",".{0,1000}SupremoRemoteDesktop\\History\.txt.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SupremoService.00.Service.log*",".{0,1000}SupremoService\.00\.Service\.log.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SupremoService.exe*",".{0,1000}SupremoService\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*SupremoSystem.exe*",".{0,1000}SupremoSystem\.exe.{0,1000}","greyware_tool_keyword","Supremo","Supremo - Remote access software","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta","RMM","https://www.supremocontrol.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*swarm.meshcentral.com*",".{0,1000}swarm\.meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*SYSLOG_IDENTIFIER=chrome-remote-desktop*",".{0,1000}SYSLOG_IDENTIFIER\=chrome\-remote\-desktop.{0,1000}","greyware_tool_keyword","Google Remote Desktop","Google Chrome Remote Desktop to access remote computers - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotedesktop.google.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*systemctl * rmm.service*",".{0,1000}systemctl\s.{0,1000}\srmm\.service.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*systemctl start pulseway*",".{0,1000}systemctl\sstart\spulseway.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*systemctl status pulseway*",".{0,1000}systemctl\sstatus\spulseway.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*systemctl stop pulseway*",".{0,1000}systemctl\sstop\spulseway.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*systemprofile\AppData\Roaming\freerdp\server*",".{0,1000}systemprofile\\AppData\\Roaming\\freerdp\\server.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Szybka pomoc Installer.exe*",".{0,1000}Szybka\spomoc\sInstaller\.exe.{0,1000}","greyware_tool_keyword","QuickAssist","Sharing remote desktop with Microsoft Quick assit","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","LokiBot","Black Basta","RMM","https://apps.microsoft.com/detail/9p7bp5vnwkx5","1","0","N/A","Quick assist could be preinstalled in some Windows versions","10","10","N/A","N/A","N/A","N/A"
"*t.me/Melteddd*",".{0,1000}t\.me\/Melteddd.{0,1000}","offensive_tool_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","1","N/A","N/A","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*Tactical RMM Agent*",".{0,1000}Tactical\sRMM\sAgent.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","#registry","registry","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*tacticalrmm.utils*",".{0,1000}tacticalrmm\.utils.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","0","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*tacticalrmm-develop*",".{0,1000}tacticalrmm\-develop.{0,1000}","greyware_tool_keyword","tacticalrmm","A remote monitoring & management tool","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","AvosLocker - Scattered Spider*","RMM","https://github.com/amidaware/tacticalrmm","1","1","N/A","N/A","10","10","3276","450","2024-11-28T19:56:21Z","2019-10-22T22:19:12Z"
"*taf.teamviewer.com*",".{0,1000}taf\.teamviewer\.com.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageAgentInformation.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageAgentInformation\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageEventViewer.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageEventViewer\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageHeartbeat.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageHeartbeat\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageInformation*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageInformation.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageInternalPoller.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageInternalPoller\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageMonitoring*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageMonitoring.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageProgramManagement*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageProgramManagement.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageRegistryExplorer.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageRegistryExplorer\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageRunCommande.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageRunCommande\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageRunCommandInteractive*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageRunCommandInteractive.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageSTRemote.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageSTRemote\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageSystemTools.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageSystemTools\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageUpgradeAgent*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageUpgradeAgent.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AgentPackageWindowsUpdate.exe*",".{0,1000}taskkill\s\/f\s\/im\sAgentPackageWindowsUpdate\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im AteraAgent.exe*",".{0,1000}taskkill\s\/f\s\/im\sAteraAgent\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*taskkill /f /im TicketingTray.exe*",".{0,1000}taskkill\s\/f\s\/im\sTicketingTray\.exe.{0,1000}","greyware_tool_keyword","Atera","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","BlackSuit - Royal - AvosLocker - BianLian - Conti - Hive - Quantum - RansomHub - Black Basta - Dispossessor","RMM","https://www.atera.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'TaskName'>\Bomgar Task *",".{0,1000}\'TaskName\'\>\\Bomgar\sTask\s.{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer VPN Adapter*",".{0,1000}TeamViewer\sVPN\sAdapter.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TEAMVIEWER.EXE-*.pf*",".{0,1000}TEAMVIEWER\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer\tv_w32.exe*",".{0,1000}TeamViewer\\tv_w32\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer\tv_x64.dll*",".{0,1000}TeamViewer\\tv_x64\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer\tv_x64.exe*",".{0,1000}TeamViewer\\tv_x64\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer\TVNetwork.log*",".{0,1000}TeamViewer\\TVNetwork\.log.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TEAMVIEWER_.EXE-*.pf*",".{0,1000}TEAMVIEWER_\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer_Desktop.exe*",".{0,1000}TeamViewer_Desktop\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TEAMVIEWER_DESKTOP.EXE-*.pf*",".{0,1000}TEAMVIEWER_DESKTOP\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer_Hooks.log*",".{0,1000}TeamViewer_Hooks\.log.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer_LogMutex*",".{0,1000}TeamViewer_LogMutex.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","#mutex","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer_Service.exe*",".{0,1000}TeamViewer_Service\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TEAMVIEWER_SERVICE.EXE-*.pf*",".{0,1000}TEAMVIEWER_SERVICE\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer_Setup_x64.exe*",".{0,1000}TeamViewer_Setup_x64\.exe.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TEAMVIEWER_SETUP_X64.EXE-*.pf*",".{0,1000}TEAMVIEWER_SETUP_X64\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer_VirtualDeviceDriver*",".{0,1000}TeamViewer_VirtualDeviceDriver.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer_XPSDriverFilter*",".{0,1000}TeamViewer_XPSDriverFilter.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer15_Logfile.log*",".{0,1000}TeamViewer15_Logfile\.log.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewer3_Win32_Instance_Mutex*",".{0,1000}TeamViewer3_Win32_Instance_Mutex.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","#mutex","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewerHooks_DynamicMemMutex*",".{0,1000}TeamViewerHooks_DynamicMemMutex.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","#mutex","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewerMeetingAddIn.dll*",".{0,1000}TeamViewerMeetingAddIn\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewerMeetingAddinShim.dll*",".{0,1000}TeamViewerMeetingAddinShim\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*TeamViewerMeetingAddinShim64.dll*",".{0,1000}TeamViewerMeetingAddinShim64\.dll.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","1","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*teamviewervpn.sys*",".{0,1000}teamviewervpn\.sys.{0,1000}","greyware_tool_keyword","teamviewer","TeamViewer Remote is software for remote assistance - control and access to computers and other terminals - abused by attackers","T1021.001 - T1059 - T1078 - T1133 - T1563","TA0001 - TA0002 - TA0005 - TA0008 - TA0011 - TA0010","N/A","LockBit - BERSERK BEAR - MUSTANG PANDA - TeamSpy Crew - BianLian - Scattered Spider* - Trigona - Yanluowang - FIN7 - LOTUS PANDA","RMM","https://www.teamviewer.com/","1","0","N/A","FP risk - teamviewer usage","10","10","N/A","N/A","N/A","N/A"
"*techws.*.swi-rc.com*",".{0,1000}techws\..{0,1000}\.swi\-rc\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*TightVNC Service*",".{0,1000}TightVNC\sService.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*TightVNC Web Site.url*",".{0,1000}TightVNC\sWeb\sSite\.url.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*To: All Representatives  From: Remote Support * has added a note to this session.*",".{0,1000}To\:\sAll\sRepresentatives\s\sFrom\:\sRemote\sSupport\s.{0,1000}\shas\sadded\sa\snote\sto\sthis\ssession\..{0,1000}","greyware_tool_keyword","Bomgar","Bomgar beyoundtrust Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.beyondtrust.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Trojan.RemoteUtilitiesRAT*",".{0,1000}Trojan\.RemoteUtilitiesRAT.{0,1000}","signature_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*Trojan.RemoteUtilitiesRAT*",".{0,1000}Trojan\.RemoteUtilitiesRAT.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*TrojanSpy:Win32/Tinukebot*",".{0,1000}TrojanSpy\:Win32\/Tinukebot.{0,1000}","signature_keyword","HVNC","Standalone HVNC Client & Server Coded in C++ (Modified Tinynuke)","T1021.005 - T1071 - T1563.002 - T1219","TA0001 - TA0002 - TA0008","N/A","N/A","RMM","https://github.com/Meltedd/HVNC","1","0","N/A","antivirus signature","10","5","423","126","2022-02-14T02:31:56Z","2021-09-03T17:34:44Z"
"*turn-*.zohomeeting.com*",".{0,1000}turn\-.{0,1000}\.zohomeeting\.com.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*turn.console.gotoassist.com*",".{0,1000}turn\.console\.gotoassist\.com.{0,1000}","greyware_tool_keyword","LogMeIn","LogMeIn is a legitimate remote support software that allows IT and customer support teams to remotely access and control devices to provide support - abused by threat actors ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","BlackSuit - Royal - Trigona - Yanluowang","RMM","https://www.logmein.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*tvnserver*",".{0,1000}tvnserver.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*tvnserver.exe*",".{0,1000}tvnserver\.exe.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*tvnviewer.exe*",".{0,1000}tvnviewer\.exe.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ui/rest/download/xeoxagentgeneric/*",".{0,1000}ui\/rest\/download\/xeoxagentgeneric\/.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ulm.aeroadmin.com/*",".{0,1000}ulm\.aeroadmin\.com\/.{0,1000}","greyware_tool_keyword","aeroadmin","RMM software - full remote control / file transfer","T1021.001 - T1048.003","TA0008 - TA0011 - TA0009 - TA0010","N/A","N/A","RMM","https://ulm.aeroadmin.com/AeroAdmin.exe","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*UltraVNC Launcher.lnk*",".{0,1000}UltraVNC\sLauncher\.lnk.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ultravnc mslogonacl*",".{0,1000}ultravnc\smslogonacl.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*UltraVNC Repeater.lnk*",".{0,1000}UltraVNC\sRepeater\.lnk.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*UltraVNC Server Settings.lnk*",".{0,1000}UltraVNC\sServer\sSettings\.lnk.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*UltraVNC Server.lnk*",".{0,1000}UltraVNC\sServer\.lnk.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ultravnc testauth*",".{0,1000}ultravnc\stestauth.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*UltraVNC Viewer.lnk*",".{0,1000}UltraVNC\sViewer\.lnk.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*UltraVNC_*_X86_Setup*",".{0,1000}UltraVNC_.{0,1000}_X86_Setup.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ULTRAVNC_1*_X86_SETUP.EXE-*.pf*",".{0,1000}ULTRAVNC_1.{0,1000}_X86_SETUP\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ultravnc_repeater*",".{0,1000}ultravnc_repeater.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ultravnc_server*",".{0,1000}ultravnc_server.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ultravnc_viewer*",".{0,1000}ultravnc_viewer.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Uninstall Remote Utilities - Viewer.lnk*",".{0,1000}Uninstall\sRemote\sUtilities\s\-\sViewer\.lnk.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Uninstall Remote Utilities Server.lnk*",".{0,1000}Uninstall\sRemote\sUtilities\sServer\.lnk.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Uninstall Remote Utilities.lnk*",".{0,1000}Uninstall\sRemote\sUtilities\.lnk.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Uninstall RemotePC.lnk*",".{0,1000}Uninstall\sRemotePC\.lnk.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*update.remoteutilities.net*",".{0,1000}update\.remoteutilities\.net.{0,1000}","greyware_tool_keyword","RemoteUtilities","RemoteUtilities Remote Access softwares","T1021 - T1083 - T1113 - T1218.007 - T1105 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","RagnarLocker - MuddyWater - UAC-0050","RMM","https://www.remoteutilities.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Uploading MeshCommander*",".{0,1000}Uploading\sMeshCommander.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","0","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*vncviewer *.*:5901*",".{0,1000}vncviewer\s.{0,1000}\..{0,1000}\:5901.{0,1000}","greyware_tool_keyword","vncviewer","linux commands abused by attackers - find guid and suid sensitives perm","T1059.003 - T1053.005 - T1105 - T1012 - T1057 - T1083 - T1041 - T1036 - T1035 - T1562.001 - T1564.001 - T1564.005 - T1564.002 - T1564.003 - T1027 - T1070.001 - T1112 - T1136","TA0003 - TA0007 - TA0008 - TA0010 - TA0006 - TA0002","N/A","N/A","RMM","N/A","1","0","#linux","greyware_tools high risks of false positives","10","10","N/A","N/A","N/A","N/A"
"*vaults.*.swi-rc.com*",".{0,1000}vaults\..{0,1000}\.swi\-rc\.com.{0,1000}","greyware_tool_keyword","Dameware","Solarwind Dameware Remote Control utilities","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.solarwinds.com/fr/remote-support-software","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*viewerhostkeypopup.exe *",".{0,1000}viewerhostkeypopup\.exe\s.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC RMM tool - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.remotedesktop.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*VNCviewer Config File*",".{0,1000}VNCviewer\sConfig\sFile.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry value","10","10","N/A","N/A","N/A","N/A"
"*VncViewer.Config*",".{0,1000}VncViewer\.Config.{0,1000}","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","0","#registry","registry","10","10","N/A","N/A","N/A","N/A"
"*VncViewer.Config*",".{0,1000}VncViewer\.Config.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","#registry","registry path","10","10","N/A","N/A","N/A","N/A"
"*VNCViewer.exe*",".{0,1000}VNCViewer\.exe.{0,1000}","greyware_tool_keyword","vncviewer","VNCViewer is an RMM tool that has been exploited by attackers to gain unauthorized remote access ","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","N/A","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*VNCVIEWER.EXE-*.pf*",".{0,1000}VNCVIEWER\.EXE\-.{0,1000}\.pf.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'VSA X Manager*",".{0,1000}\'VSA\sX\sManager.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'VSA X Remote Control'*",".{0,1000}\'VSA\sX\sRemote\sControl\'.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'VSA X Service'*",".{0,1000}\'VSA\sX\sService\'.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*'VSA X User Agent'*",".{0,1000}\'VSA\sX\sUser\sAgent\'.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*vsxrc-client.dll*",".{0,1000}vsxrc\-client\.dll.{0,1000}","greyware_tool_keyword","kaseya VSA","Kaseya VSA (Virtual System Administrator) is a cloud-based IT management and remote monitoring software designed for managed service providers (MSPs) and IT departments -it is abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.kaseya.com/products/vsa/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*-web.screenconnect.com*",".{0,1000}\-web\.screenconnect\.com.{0,1000}","greyware_tool_keyword","ScreenConnect","ConnectWise Control formerly known as Screenconnect is a remote desktop software application.","T1021.001 - T1133","TA0008 - TA0009 - TA0010 - TA0011","N/A","Black Basta - BlackCat - LockBit - Scattered Spider* - Hive - Trigona - Medusa - Yanluowang - GOLD SOUTHFIELD - MuddyWater ","RMM","https://screenconnect.connectwise.com/download","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*web1.remotepc.com*",".{0,1000}web1\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*whatsmyip.ccrmm.avg.com*",".{0,1000}whatsmyip\.ccrmm\.avg\.com.{0,1000}","greyware_tool_keyword","BarracudaRMM","Deliver remote support services - formely AVG","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://www.barracudamsp.com/products/rmm/barracuda-rmm","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*Win32.PUA.AmmyyAdmin*",".{0,1000}Win32\.PUA\.AmmyyAdmin.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*Win32.PUA.AmmyyAdmin*",".{0,1000}Win32\.PUA\.AmmyyAdmin.{0,1000}","signature_keyword","Ammyy Admin","Antiviurs signature_keyword","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","N/A","1","0","#Avsignature","N/A","10","10","N/A","N/A","N/A","N/A"
"*WindowsStoreAppExporter.exe*",".{0,1000}WindowsStoreAppExporter\.exe.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*winst64.exe* /q /q /ex /i*",".{0,1000}winst64\.exe.{0,1000}\s\/q\s\/q\s\/ex\s\/i.{0,1000}","greyware_tool_keyword","NetSupport","NetSupport Manager is a remote access tool that can be used legitimately for IT management but has also been abused  by adversaries for remote system control and surveillance","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Cuba - EvilCorp* - Black Basta - Moskalvzapoe","RMM","https://www.netsupportmanager.com/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*WinVNC.exe*",".{0,1000}WinVNC\.exe.{0,1000}","greyware_tool_keyword","UltraVNC","UltraVNC remote access software usage","T1021.001 - T1219 - T1076 - T1563.002","TA0008 - TA0009 - TA0010 - TA0011","N/A","Dispossessor - Gamaredon Group - APT39","RMM","https://uvnc.com/downloads/ultravnc.html","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*wss://meshcentral.com*",".{0,1000}wss\:\/\/meshcentral\.com.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*www.ammyy.com/files/v*",".{0,1000}www\.ammyy\.com\/files\/v.{0,1000}","greyware_tool_keyword","Ammyy Admin","Ammyy Admin is a remote desktop software application abudsed by attackers","T1021 - T1219 - T1563 - T1608","TA0002 - TA0008 - TA0011 - TA0040","N/A","Anunak","RMM","https://www.ammyy.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.anyplace-control.com/install*",".{0,1000}www\.anyplace\-control\.com\/install.{0,1000}","greyware_tool_keyword","AnyplaceControl","access your unattended PC from anywhere","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","www.anyplace-control[.]com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.dwservice.net*",".{0,1000}www\.dwservice\.net.{0,1000}","greyware_tool_keyword","dwagent","The DWService to remotly control your machine - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://github.com/dwservice/agent","1","1","N/A","N/A","10","5","446","82","2023-03-22T08:45:16Z","2019-01-23T10:40:24Z"
"*www.pulseway.com/download/*",".{0,1000}www\.pulseway\.com\/download\/.{0,1000}","greyware_tool_keyword","Pulseway","Pulseway - remote monitoring and management tool designed for IT administrators to monitor and manage their IT systems and infrastructure remotely - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.pulseway.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.splashtop.com/remotecaRemoveVRootsISCHECKFORPRODUCTUPDATES*",".{0,1000}www\.splashtop\.com\/remotecaRemoveVRootsISCHECKFORPRODUCTUPDATES.{0,1000}","greyware_tool_keyword","Splashtop","control remote machines- abused by threat actors","T1021.001 - T1078 - T1133 - T1112","TA0008 - TA0003 - TA0004 - TA0005 - TA0011 - TA0010","N/A","Black Basta - LockBit - AvosLocker - BianLian - Scattered Spider* - Hive - Quantum - Conti - Trigona - RansomHub - Cactus","RMM","https://hybrid-analysis.com/sample/18c10b0235bd341e065ac5c53ca04b68eaeacd98a120e043fb4883628baf644e/6267eb693836e7217b1a3c72","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www.tightvnc.com/download/*=",".{0,1000}www\.tightvnc\.com\/download\/.{0,1000}\=","greyware_tool_keyword","tightvnc","TightVNC is a free and Open Source remote desktop software that lets you access and control a computer over the network - often abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://www.tightvnc.com","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*www1.remotepc.com*",".{0,1000}www1\.remotepc\.com.{0,1000}","greyware_tool_keyword","RemotePC","RemotePC Remote administration tool","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","Scattered Spider*","RMM","https://remotepc.com/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*XEOX Agent for Windows*",".{0,1000}XEOX\sAgent\sfor\sWindows.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","#servicename","N/A","10","10","N/A","N/A","N/A","N/A"
"*XEOX Agent Service*",".{0,1000}XEOX\sAgent\sService.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","application name","10","10","N/A","N/A","N/A","N/A"
"*xeox.com/ui/download/*",".{0,1000}xeox\.com\/ui\/download\/.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*xeox_service_windows.exe*",".{0,1000}xeox_service_windows\.exe.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*xeox-agent_*.exe*",".{0,1000}xeox\-agent_.{0,1000}\.exe.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*xeox-agent_x64.exe*",".{0,1000}xeox\-agent_x64\.exe.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*xeox-agent_x86.exe*",".{0,1000}xeox\-agent_x86\.exe.{0,1000}","greyware_tool_keyword","xeox","Easily access and manage Windows devices remotely within XEOX - RMM abused by threat actors","T1021 - T1078 - T1219 - T1105 - T1046","TA0011 - TA0010 - TA0003 - TA0005","N/A","Dispossessor","RMM","https://xeox.com/remote-access/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ylAo2kAlUS2kYkala!*",".{0,1000}ylAo2kAlUS2kYkala!.{0,1000}","greyware_tool_keyword","Quasar","Open-Source Remote Administration Tool for Windows. Quasar is a fast and light-weight remote administration tool coded in C#.","T1548.002 - T1547.001 - T1059.003 - T1555 - T1005 - T1573.001 - T1564.001 - T1564.003 - T1105 - T1056.001 - T1112 - T1095 - T1571 - T1090 - T1021.001 - T1053.005 - T1553.002 - T1082 - T1614 - T1016 - T1033 - T1552.001 - T1125","TA0002 - TA0003 - TA0005 - TA0006 - TA0008 - TA0009 - TA0011 - TA0040","N/A","Patchwork - LazyScripter - Gorgon Group - menuPass - BackdoorDiplomacy - Earth Berberoka - APT33 - APT32 - Operation C-Major - QUILTED TIGER - Molerats","RMM","https://github.com/quasar/Quasar","1","0","N/A","N/A","N/A","10","8827","2490","2024-02-29T06:37:37Z","2014-07-08T12:27:59Z"
"*Ylianst/MeshAgent*",".{0,1000}Ylianst\/MeshAgent.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshAgent","1","1","N/A","N/A","10","3","235","90","2024-11-26T20:49:56Z","2017-10-12T21:26:52Z"
"*Ylianst/MeshCentral*",".{0,1000}Ylianst\/MeshCentral.{0,1000}","greyware_tool_keyword","meshcentral","MeshCentral is a full computer management web site - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","N/A","RMM","https://github.com/Ylianst/MeshCentral","1","1","N/A","N/A","10","10","4349","581","2024-12-07T14:41:24Z","2017-08-28T16:21:11Z"
"*ZA_Connect.exe *",".{0,1000}ZA_Connect\.exe\s.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ZA_Connect.exe.ApplicationCompany*",".{0,1000}ZA_Connect\.exe\.ApplicationCompany.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ZAFileTransfer.exe *",".{0,1000}ZAFileTransfer\.exe\s.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ZAService.exe *",".{0,1000}ZAService\.exe\s.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ZOHO CORPORATION PRIVATE LIMITED*",".{0,1000}ZOHO\sCORPORATION\sPRIVATE\sLIMITED.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ZohoMeeting.exe*",".{0,1000}ZohoMeeting\.exe.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","1","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ZohoMeeting\FileTransferSettings.conf*",".{0,1000}ZohoMeeting\\FileTransferSettings\.conf.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"
"*ZohoMeeting\Service.Conf*",".{0,1000}ZohoMeeting\\Service\.Conf.{0,1000}","greyware_tool_keyword","Zoho Assist","Zoho Assist Remote access software - abused by attackers","T1021 - T1071 - T1090","TA0003 - TA0008 - TA0011","N/A","LockBit - Scattered Spider*","RMM","https://www.zoho.com/assist/","1","0","N/A","N/A","10","10","N/A","N/A","N/A","N/A"