Remote Management and Monitoring tool - Panorama9 - Create Process

Hunt Hypothesis

A threat hunter should investigate processes created by the Panorama9 tool as it may indicate adversary use of a Remote Management and Monitoring tool for persistence or command and control. Proactively hunting for this behavior in Azure Sentinel helps identify potential compromise of endpoints managed by RMM tools, which are increasingly exploited by attackers.

KQL Query

let Time_start = now(-5d);
let Time_end = now();
//
DeviceProcessEvents 
| where Timestamp between (Time_start..Time_end)
| where ProcessVersionInfoCompanyName has 'panorama9'
    or ProcessVersionInfoProductName has 'panorama9'
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName

Analytic Rule Definition

id: 277a8a9d-8f33-43ea-8977-0de619772d01
name: Remote Management and Monitoring tool - Panorama9 - Create Process
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceProcessEvents 
  | where Timestamp between (Time_start..Time_end)
  | where ProcessVersionInfoCompanyName has 'panorama9'
      or ProcessVersionInfoProductName has 'panorama9'
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName

Required Data Sources

MITRE ATT&CK Context

• Tactic: CommandAndControl
• Technique: T1219 — T1219

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_Panorama9_createproc.yaml)

False Positive Guidance

• Scenario: Scheduled Job to Create a Process for System Maintenance
  Description: A legitimate scheduled job runs a script to create a process as part of routine system maintenance using Panorama9.
  Filter/Exclusion: process.parent_process_name == "Task Scheduler" or process.command_line contains "scheduled_task"

• Scenario: Admin Task to Deploy a Patch via Panorama9
  Description: An administrator uses Panorama9 to deploy a software update, which involves creating a process on remote endpoints.
  Filter/Exclusion: process.command_line contains "patch" or "update" or process.user contains "admin"

• Scenario: Remote PowerShell Script Execution for Configuration Management
  Description: A system administrator runs a PowerShell script via Panorama9 to configure remote endpoints, which creates a process on the target machine.
  Filter/Exclusion: process.command_line contains "powershell.exe" and "Configure" or "Setup"

• Scenario: Log Collection Process Initiated by Panorama9 Agent
  Description: The Panorama9 agent initiates a process to collect system logs from a remote endpoint as part of its monitoring function.
  Filter/Exclusion: process.command_line contains "log_collect" or "syslog"

• Scenario: Process Creation for a Legitimate Monitoring Tool Integration
  Description: A third-party monitoring tool integrates with Panorama9, and the integration requires creating a process on the endpoint for data collection.
  Filter/Exclusion: process.file_name contains "monitoring_tool.exe" or process.parent_process_name == "Panorama9 Agent"