257. Adversaries Abuse ITarian for Command and Control
Hello everyone! Adversaries keep experimenting with various RMM tools. So, today we'll look at another example of Remote Access Tools: Remote Desktop Software (T1219.002) . According to Red Canary report , this time threat actors abused ITarian . Despite the fact the installer dropped ITarian executable to legitimate location, I think it's better to focus on its metadata, for example, CompanyName, so we can hunt for renamed versions of this RMM as well: event_type: "processcreatewin" AND proc_file_companyname: "itarian" See you tomorrow!