Remote support agent spawning a shell or script host

Siemphony@siemphonyhighT1219verified in lab

Step four of MITRE's behaviour chain is the only part of it that lands in a single event: interactive control signals arriving over the remote access session appear as shell or script-host children spawned by the agent process. Execution of a remote support tool on its own is ordinary in any estate that runs remote administration, and the persistence and long-lived egress steps need a correlation window Sigma has no way to carry, so this rule matches the parent-child pair instead — a remote-control or remote management agent as ParentImage and a command interpreter, script host or download-capable binary as Image. Both halves are single-field value lists, which keeps the rule to one AND of two fields. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0496, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\AnyDesk.exe" or InitiatingProcessFolderPath endswith "\\TeamViewer.exe" or InitiatingProcessFolderPath endswith "\\TeamViewer_Service.exe" or InitiatingProcessFolderPath endswith "\\ScreenConnect.ClientService.exe" or InitiatingProcessFolderPath endswith "\\ScreenConnect.WindowsClient.exe" or InitiatingProcessFolderPath endswith "\\rutserv.exe" or InitiatingProcessFolderPath endswith "\\rfusclient.exe" or InitiatingProcessFolderPath endswith "\\AteraAgent.exe" or InitiatingProcessFolderPath endswith "\\SRService.exe" or InitiatingProcessFolderPath endswith "\\SRManager.exe" or InitiatingProcessFolderPath endswith "\\Supremo.exe" or InitiatingProcessFolderPath endswith "\\UltraViewer_Desktop.exe" or InitiatingProcessFolderPath endswith "\\LogMeIn.exe" or InitiatingProcessFolderPath endswith "\\LMIGuardianSvc.exe" or InitiatingProcessFolderPath endswith "\\dwrcs.exe" or InitiatingProcessFolderPath endswith "\\NinjaRMMAgent.exe" or InitiatingProcessFolderPath endswith "\\SyncroLive.Agent.exe" or InitiatingProcessFolderPath endswith "\\GoToAssist.exe" or InitiatingProcessFolderPath endswith "\\AA_v3.exe") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe" or FolderPath endswith "\\regsvr32.exe" or FolderPath endswith "\\bitsadmin.exe" or FolderPath endswith "\\certutil.exe"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\AnyDesk.exe" OR ParentImage="*\\TeamViewer.exe" OR ParentImage="*\\TeamViewer_Service.exe" OR ParentImage="*\\ScreenConnect.ClientService.exe" OR ParentImage="*\\ScreenConnect.WindowsClient.exe" OR ParentImage="*\\rutserv.exe" OR ParentImage="*\\rfusclient.exe" OR ParentImage="*\\AteraAgent.exe" OR ParentImage="*\\SRService.exe" OR ParentImage="*\\SRManager.exe" OR ParentImage="*\\Supremo.exe" OR ParentImage="*\\UltraViewer_Desktop.exe" OR ParentImage="*\\LogMeIn.exe" OR ParentImage="*\\LMIGuardianSvc.exe" OR ParentImage="*\\dwrcs.exe" OR ParentImage="*\\NinjaRMMAgent.exe" OR ParentImage="*\\SyncroLive.Agent.exe" OR ParentImage="*\\GoToAssist.exe" OR ParentImage="*\\AA_v3.exe") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\certutil.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\anydesk.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\teamviewer.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\teamviewer_service.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\screenconnect.clientservice.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\screenconnect.windowsclient.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\rutserv.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\rfusclient.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\ateraagent.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\srservice.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\srmanager.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\supremo.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\ultraviewer_desktop.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\logmein.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\lmiguardiansvc.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\dwrcs.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\ninjarmmagent.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\syncrolive.agent.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\gotoassist.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\aa_v3.exe") AND (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bitsadmin.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(\\AnyDesk\.exe$|\\TeamViewer\.exe$|\\TeamViewer_Service\.exe$|\\ScreenConnect\.ClientService\.exe$|\\ScreenConnect\.WindowsClient\.exe$|\\rutserv\.exe$|\\rfusclient\.exe$|\\AteraAgent\.exe$|\\SRService\.exe$|\\SRManager\.exe$|\\Supremo\.exe$|\\UltraViewer_Desktop\.exe$|\\LogMeIn\.exe$|\\LMIGuardianSvc\.exe$|\\dwrcs\.exe$|\\NinjaRMMAgent\.exe$|\\SyncroLive\.Agent\.exe$|\\GoToAssist\.exe$|\\AA_v3\.exe$)</field>    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\bitsadmin\.exe$|\\certutil\.exe$)</field>    <description>Remote support agent spawning a shell or script host</description>    <mitre>      <id>T1219</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: reverse_shell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: dfe5a8d3-eb3b-4a37-bfcb-3a75cc02b57f

ATT&CKT1219

T1219Remote Access Tools

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

AN1366 has four steps: the remote-access agent starts, persists as a service or autorun, holds a long-lived tunnel out, and emits interactive control signals as child processes. Steps one to three are either ordinary — any estate with a helpdesk runs remote administration — or need a correlation window Sigma cannot carry. Step four lands in a single event, so this rule matches exactly that: a remote-control or RMM binary as ParentImage, a command interpreter or download-capable LOLBin as Image. Read a hit as "someone drove a shell through the support agent", not as "someone abused remote access".

02 · Telemetry you need

category: process_creation / product: windows, copied verbatim from AN1366, whose Windows source is Sysmon EventID 1. All four backends render — but the Sentinel translation targets SecurityEvent | where EventID == 4688 and maps ParentImage to ParentProcessName. 4688 requires Audit Process Creation to exist at all, and its parent field is weaker than Sysmon's. The same YAML is a stronger detection on Sysmon than on Sentinel; that difference is invisible in rule.yml and visible only in translations.json.

03 · How the logic works

Two selections, each one field with a value list, ANDed. ParentImage|endswith carries nineteen entries — AnyDesk, TeamViewer.exe, TeamViewer_Service.exe, both ScreenConnect binaries, RMS (rutserv.exe, rfusclient.exe), Atera, Supremo, UltraViewer, LogMeIn, dwrcs.exe, NinjaRMM, Syncro, GoToAssist, AA_v3.exe. Image|endswith carries ten: \cmd.exe, \powershell.exe, \pwsh.exe, \wscript.exe, \cscript.exe, \mshta.exe, \rundll32.exe, \regsvr32.exe, \bitsadmin.exe, \certutil.exe. endswith beats a full path because these agents install under Program Files, ProgramData, per-user and versioned directories; pinning a path breaks on the next release. One field per half is what lets Wazuh render it. The rule assumes the agent is the parent of the shell. True for the scripted surface: ScreenConnect Backstage spawning cmd.exe under ScreenConnect.ClientService.exe, or an Atera/NinjaRMM PowerShell job. False for GUI screen sharing — the dominant real-world abuse of AnyDesk, TeamViewer and Quick Assist — where the operator sees the desktop, clicks Start, and the shell's parent is explorer.exe. TeamViewer's remote-control surface is also TeamViewer_Desktop.exe, not the listed TeamViewer.exe, so even the named tool carries the wrong binary for the GUI path. Catching that needs an explorer.exe-parented shell joined against a concurrent RAT session — a correlation Sigma cannot express. Second: DET0496 is titled Tool-Agnostic, and this is a closed list of nineteen product names, the inverse of that intent. Coverage equals the author's tool memory. Absent and operationally important: quickassist.exe (in-box Windows, the primary RAT in Black Basta/Storm-1811 intrusions), rustdesk.exe, ConnectWise Automate (LTSvc.exe), Kaseya (AgentMon.exe), Chrome Remote Desktop (remoting_host.exe).

04 · Common false positives

The rule's own first false positive concedes the problem: a platform running a maintenance script is indistinguishable from an operator typing at a shell over the same agent. The reviewer went further — Atera and NinjaRMM run inline cmd.exe/powershell.exe health probes every one to five minutes on every managed endpoint by design, orders of magnitude more volume than the scheduled patch jobs the false positives describe. Add agent self-update routines calling certutil.exe or rundll32.exe, and jump hosts where remote administration is the machine's purpose.
level: high is contestable for that reason. A rule whose own documentation says the true positive cannot be separated from the dominant benign case is a rule that gets muted in week one. Drop to medium, or keep high and treat the agent exclusion as a deployment precondition rather than a tuning suggestion.

05 · Detection maturity

tier_1: . Machine-derived from MITRE's scaffold — no query logic exists upstream — and never run against a log line. It will genuinely fire on ScreenConnect Backstage and RMM script execution, which is real T1219, but that is reasoning, not evidence.
tier_2: inventory the remote-access tools actually installed in your estate, replace the guessed nineteen with the real set, and baseline a week of agent-parented shells to see how much is health probing.
tier_3: ** move to the allowlist inversion, add the explorer.exe-parented correlation, and bring in AN1366's service-creation (7045) and egress legs behind MITRE's TimeWindow and EgressHeuristics knobs.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's ProcessAllowlist knob is the first lever, and direction matters:
MITRE's InstallPathRegex knob is the better inversion — an agent binary
MITRE's UserContext knob separates jump hosts and helpdesk accounts from
Add quickassist.exe and rustdesk.exe at minimum, while understanding that
Known ceiling, unfixable in a stateless rule: once an operator has interactive

Declared by the author

Sanctioned helpdesk and RMM automation. A remote management platform running maintenance scripts is indistinguishable from an operator typing at a shell over the same agent, and MITRE's ProcessAllowlist knob exists precisely to suppress the agents your organisation licenses. Suppress by agent, not by child process.
Software deployment and patching jobs pushed through an RMM agent, which shell out to cmd.exe or powershell.exe to run installers and post-install tasks on a predictable maintenance schedule.
Agent self-update and repair routines that call rundll32.exe or certutil.exe as part of installing their own new build under the service account.
Jump hosts and support workstations where remote administration is the machine's purpose. MITRE's UserContext knob is the intended separator here, and this rule deliberately encodes no user filter.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Remote access software
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1219, evaluated against their process_creation events.

Share this rule

/u/siemphony/dfe5a8d3-eb3b-4a37-bfcb-3a75cc02b57f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Remote support agent spawning a shell or script host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it