LoFP LoFP / the rule doesn't look for anything suspicious so false positives are expected. if you use one of the tools mentioned, comment it out

Techniques

Sample rules

Remote Access Tool Services Have Been Installed - Security

Description

Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Detection logic

condition: selection
selection:
  EventID: 4697
  ServiceName|contains:
  - AmmyyAdmin
  - AnyDesk
  - Atera
  - BASupportExpressSrvcUpdater
  - BASupportExpressStandaloneService
  - chromoting
  - GoToAssist
  - GoToMyPC
  - jumpcloud
  - LMIGuardianSvc
  - LogMeIn
  - monblanking
  - Parsec
  - RManService
  - RPCPerformanceService
  - RPCService
  - SplashtopRemoteService
  - SSUService
  - TeamViewer
  - TightVNC
  - vncserver
  - Zoho