Remote Management and Monitoring tool - ServerEye - Network Connection

Hunt Hypothesis

The hypothesis is that an adversary is using ServerEye, a remote management tool, to establish unauthorized network connections for command and control or persistence. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential compromise of endpoints managed by RMM tools.

KQL Query

let Time_start = now(-5d);
let Time_end = now();
//
DeviceNetworkEvents
| where Timestamp between (Time_start..Time_end)
| where RemoteUrl has 'server-eye.de'
    and InitiatingProcessVersionInfoCompanyName has 'Krämer IT Solutions GmbH'
    and InitiatingProcessVersionInfoProductName has_any (
        'ServerEye', 
        'Server-Eye'
    )
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
    RemoteUrl 

Analytic Rule Definition

id: 8f8aa8e8-90a1-43cf-852c-ba54c63a973d
name: Remote Management and Monitoring tool - ServerEye - Network Connection
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceNetworkEvents
  | where Timestamp between (Time_start..Time_end)
  | where RemoteUrl has 'server-eye.de'
      and InitiatingProcessVersionInfoCompanyName has 'Krämer IT Solutions GmbH'
      and InitiatingProcessVersionInfoProductName has_any (
          'ServerEye', 
          'Server-Eye'
      )
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
      RemoteUrl 

Required Data Sources

MITRE ATT&CK Context

• Tactic: CommandAndControl
• Technique: T1219 — T1219

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_ServerEye_netconn.yaml)

False Positive Guidance

• Scenario: Scheduled Job for System Monitoring
  Description: A legitimate scheduled job runs via ServerEye to periodically check system health and log metrics.
  Filter/Exclusion: process.parent_process_name:"Task Scheduler" or process.name:"ServerEyeMonitor.exe"

• Scenario: Admin Task to Update ServerEye Agent
  Description: An administrator manually initiates an update to the ServerEye agent on a remote server.
  Filter/Exclusion: process.user:"admin_user" or process.command_line:"ServerEyeUpdate.exe"

• Scenario: Remote Desktop Session Using ServerEye
  Description: A user connects to a remote server using Remote Desktop and the ServerEye agent is active during the session.
  Filter/Exclusion: process.parent_process_name:"mstsc.exe" or process.parent_process_name:"tsclient.exe"

• Scenario: Network Discovery via ServerEye for Inventory Purposes
  Description: ServerEye is used to scan the internal network for inventory purposes, identifying active hosts and services.
  Filter/Exclusion: process.command_line:"ServerEyeScan.exe" or network.destination_ip:"internal_subnet"

• Scenario: Log Collection via ServerEye for Compliance
  Description: ServerEye is configured to collect and forward logs from multiple servers to a centralized logging system.
  Filter/Exclusion: process.command_line:"ServerEyeLogCollector.exe" or network.destination_port:"514" (syslog)