{"id":"2db93a3f-3249-4f73-9e68-0e77a0f8ae7e","title":"Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server","description":"Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.\nThese parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.\nThis technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.\n","author":"Ahmed Nosir (@egycondor)","status":"experimental","level":"medium","date":"2025-05-29","modified":"","tags":["attack.command-and-control","attack.t1219","attack.t1105"],"technique_ids":["T1105","T1219"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate system administrator deploying TacticalRMM"],"references":["https://github.com/amidaware/tacticalrmm","https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3"],"source_path":"rules/windows/process_creation/proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.yml","source_sha256":"9a082071ae669e121c51bbc596dbb335d530035fc5aebbb357d3059df3b63a24","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server\nid: 2db93a3f-3249-4f73-9e68-0e77a0f8ae7e\nstatus: experimental\ndescription: |\n    Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.\n    These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.\n    This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.\nreferences:\n    - https://github.com/amidaware/tacticalrmm\n    - https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3\nauthor: Ahmed Nosir (@egycondor)\ndate: 2025-05-29\ntags:\n    - attack.command-and-control\n    - attack.t1219\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|contains: '\\TacticalAgent\\tacticalrmm.exe'\n        CommandLine|contains|all:\n            - '--api'\n            - '--auth'\n            - '--client-id'\n            - '--site-id'\n            - '--agent-type'\n    condition: selection\nfalsepositives:\n    - Legitimate system administrator deploying TacticalRMM\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1219","id":"T1219","name":"Remote Access Tools","page":"techniques/enterprise/T1219/"}],"data_path":"data/detection-rules/2db93a3f-3249-4f73-9e68-0e77a0f8ae7e.json","kind":"sigma"}