Consider Nizlo indicators in Windows RMM Tool Execution detection
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 65/100
Research direction
Read detections/endpoint/windows_rmm_tool_execution.yml and review the existing RMM identifiers and false-positive guidance. Compare the proposed company and image identifiers with the linked Nizlo indicator sources, then follow the repository’s contributor-agreement and validation workflow. Done means the analytic has the agreed narrow identifier update and retains its existing false-positive boundary.
Written by the indexing model from the issue text.
Description
Suggested narrow update
Would you consider adding Nizlo's current Windows RMM identifiers to detections/endpoint/windows_rmm_tool_execution.yml?
The existing analytic already treats legitimate RMM execution as contextual evidence and warns about normal IT use. Nizlo is legitimate remote monitoring and management software, so a match should retain that same false-positive boundary and should not imply compromise by itself.
Source-backed identifiers:
Company:Cloud 84 Holdings, LLC(a bounded match such asCloud 84 Holdings*)Image:Nizlo.Agent.exeImage:Nizlo.Agent.Updater.exeImage:Nizlo.RemoteBridge.exe
Evidence:
- Canonical security-indicator guide: https://nizlo.com/guides/nizlo-rmm-security-indicators
- Machine-readable indicator CSV: https://izikipizi.github.io/nizlo-security-indicators/indicators.csv
- Current signed-installer certificate evidence: https://github.com/jkerai1/SoftwareCertificates/tree/main/Remote%20Access%20Tools
- Independent upstream use of the same executable names: https://github.com/CrowdStrike/logscale-community-content/tree/main/Misc/crwd_live_rmm
The guide and CSV document the normal install locations and explicitly recommend correlating any hit with signer validity, path, authorization, parent process, command line, and surrounding activity. The current Windows installer is Authenticode-signed by CLOUD 84 HOLDINGS, LLC.
I am affiliated with Nizlo and am proposing this for defensive coverage, not as evidence that Nizlo is malicious. If the maintainers agree the scope belongs in this analytic, I can prepare the minimal YAML/version/date/reference update after satisfying Splunk's contributor-agreement requirement and the repository's validation workflow.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 507
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 35
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/security_content
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 78/100
splunk/security_content#4418 ·
Maintainers usually reply within 1 day
-
[BUG] Windows New EventLog ChannelAccess Registry Value Set: second path has single backslashesOpenbug
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
splunk/security_content#4417 ·
Maintainers usually reply within 1 day
-
[BUG]Linux Change File Owner To Root: detection bypass using "chown root: <file>"Possibly taken @thegreatmhn claimed this 1 day ago. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
splunk/security_content#4413 · 4 comments ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
splunk/security_content#4400 ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
splunk/security_content#4409 ·
Maintainers usually reply within 1 day
All issues in splunk/security_content
Similar issues
-
[Bug / Enhancement]: Improve teleop_robot CLI with configurable timeout, robust input validation, and clean ROS shutdownPossibly taken @muskan-creates352 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 3 days
-
bug(pipelines): shortcode stripping deletes text between a {{< >}} shortcode and the next {{% %}}Possibly taken @Ashborne-lab claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
kubeflow/docs-agent#293 ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Imbad0202/academic-research-skills#1093 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
pierreaubert/gpui-toolkit#114 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Lightricks/LTX-2#336 · 1 comment ·