{"id":"9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d","title":"Potentially Suspicious File Creation by OpenEDR's ITSMService","description":"Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.\nThe ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.\nWhile legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.\n","author":"@kostastsale","status":"experimental","level":"medium","date":"2026-02-19","modified":"","tags":["attack.command-and-control","attack.t1105","attack.lateral-movement","attack.t1570","attack.t1219"],"technique_ids":["T1105","T1219","T1570"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Legitimate OpenEDR file management operations","Authorized remote file uploads by IT administrators","Software deployment through OpenEDR console"],"references":["https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c"],"source_path":"rules/windows/file/file_event/file_event_win_comodo_itsm_potentially_suspicious_file_creation.yml","source_sha256":"6878f8ccd3041aaed94676d91839a4e584ec28986b41a0449abb25b487394ba1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_comodo_itsm_potentially_suspicious_file_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious File Creation by OpenEDR's ITSMService\nid: 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d\nstatus: experimental\ndescription: |\n    Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.\n    The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.\n    While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.\nauthor: '@kostastsale'\ndate: 2026-02-19\nreferences:\n    - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c\ntags:\n    - attack.command-and-control\n    - attack.t1105\n    - attack.lateral-movement\n    - attack.t1570\n    - attack.t1219\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection_process:\n        Image|endswith: '\\COMODO\\Endpoint Manager\\ITSMService.exe'\n    selection_suspicious_extensions:\n        TargetFilename|endswith:\n            - '.7z'\n            - '.bat'\n            - '.cmd'\n            - '.com'\n            - '.dll'\n            - '.exe'\n            - '.hta'\n            - '.js'\n            - '.pif'\n            - '.ps1'\n            - '.rar'\n            - '.scr'\n            - '.vbe'\n            - '.vbs'\n            - '.zip'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate OpenEDR file management operations\n    - Authorized remote file uploads by IT administrators\n    - Software deployment through OpenEDR console\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1219","id":"T1219","name":"Remote Access Tools","page":"techniques/enterprise/T1219/"},{"key":"enterprise/T1570","id":"T1570","name":"Lateral Tool Transfer","page":"techniques/enterprise/T1570/"}],"data_path":"data/detection-rules/9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d.json","kind":"sigma"}