✄𐘗
text code block:
✄𐘗from logs-endpoint.events.process-*, logs-crowdstrike.fdr*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*, logs-system.security*, logs-windows.sysmon_operational-*, logs-windows.forwarded*, winlogbeat-* metadata _id, _version, _index
| where (host.os.type == "windows" or host.os.family == "windows")
    and event.category == "process"
    and event.type == "start"
    and process.name is not null
| eval Esql.rmm_vendor = case(
    process.name.caseless like "aa_v*.exe", "AnyAssist",
    process.name.caseless == "acroniscyberprotectconnectagent.exe", "Acronis",
    process.name.caseless == "aeroadmin.exe", "AeroAdmin",
    process.name.caseless == "agentmon.exe", "ConnectWiseAutomate",
    process.name.caseless == "anydesk.exe", "AnyDesk",
    process.name.caseless == "apc_admin.exe", "APC",
    process.name.caseless == "apc_host.exe", "APC",
    process.name.caseless == "ateraagent.exe", "Atera",
    process.name.caseless like "aweray_remote*.exe", "AweSun",
    process.name.caseless == "awesun.exe", "AweSun",
    process.name.caseless == "b4-service.exe", "BeyondTrust",
    process.name.caseless == "basupsrvc.exe", "BeyondTrust",
    process.name.caseless == "bomgar-scc.exe", "BeyondTrust",
    process.name.caseless == "remote support.exe", "BeyondTrust",
    process.name.caseless == "cagservice.exe", "BarracudaRMM",
    process.name.caseless == "cloudracmd.exe", "CloudRadial",
    process.name.caseless == "cloudrasd.exe", "CloudRadial",
    process.name.caseless == "cloudraservice.exe", "CloudRadial",
    process.name.caseless like "connectwisecontrol*.exe", "ScreenConnect",
    process.name.caseless == "domotzagent.exe", "Domotz",
    process.name.caseless == "domotz-windows-x64-10.exe", "Domotz",
    process.name.caseless == "dwagsvc.exe", "DWService",
    process.name.caseless == "dwrcc.exe", "DWService",
    process.name.caseless == "dwrcs.exe", "DWService",
    process.name.caseless == "dwrcst.exe", "DWService",
    process.name.caseless like "fleetdeck_commander*.exe", "FleetDeck",
    process.name.caseless == "g2aservice.exe", "GoTo",
    process.name.caseless == "getscreen.exe", "GetScreen",
    process.name.caseless == "gotoassistservice.exe", "GoTo",
    process.name.caseless == "gotohttp.exe", "GoTo",
    process.name.caseless == "gotoresolveprocesschecker.exe", "GoTo",
    process.name.caseless == "gotoresolveremotecontrol.exe", "GoTo",
    process.name.caseless == "gotoresolveservice.exe", "GoTo",
    process.name.caseless == "gotoresolveterminal.exe", "GoTo",
    process.name.caseless == "gotoresolveunattended.exe", "GoTo",
    process.name.caseless == "helpwire.exe", "HelpWire",
    process.name.caseless == "immyagent.exe", "ImmyBot",
    process.name.caseless == "immybot.agent.ephemeral.exe", "ImmyBot",
    process.name.caseless == "immyupdater.exe", "ImmyBot",
    process.name.caseless == "imperoclientsvc.exe", "Impero",
    process.name.caseless == "imperoserversvc.exe", "Impero",
    process.name.caseless == "isllight.exe", "ISLOnline",
    process.name.caseless == "isllightclient.exe", "ISLOnline",
    process.name.caseless == "jumpcloud-agent.exe", "JumpCloud",
    process.name.caseless == "komari.exe", "Komari",
    process.name.caseless == "komari-agent.exe", "Komari",
    process.name.caseless == "level.exe", "Level",
    process.name.caseless == "lmi_rescue.exe", "LogMeIn",
    process.name.caseless == "lmi_rescue_srv.exe", "LogMeIn",
    process.name.caseless == "lmiignition.exe", "LogMeIn",
    process.name.caseless == "logmein.exe", "LogMeIn",
    process.name.caseless == "ltsvc.exe", "ConnectWiseAutomate",
    process.name.caseless == "ltsvcmon.exe", "ConnectWiseAutomate",
    process.name.caseless == "lttray.exe", "ConnectWiseAutomate",
    process.name.caseless == "lunixar.exe", "Lunixar",
    process.name.caseless == "lunixarremote.exe", "Lunixar",
    process.name.caseless == "lunixarupdater.exe", "Lunixar",
    process.name.caseless == "lvagent.exe", "Level",
    process.name.caseless == "manageengine_remote_access_plus.exe", "ManageEngine",
    process.name.caseless == "meshagent.exe", "MeshCentral",
    process.name.caseless == "mikogo-service.exe", "Mikogo",
    process.name.caseless == "nezha-agent.exe", "Nezha",
    process.name.caseless == "ninjarmmagent.exe", "NinjaOne",
    process.name.caseless == "ninjarmmagentpatcher.exe", "NinjaOne",
    process.name.caseless == "ninjarmm-cli.exe", "NinjaOne",
    process.name.caseless == "parsec.exe", "Parsec",
    process.name.caseless == "pservice.exe", "Pulseway",
    process.name.caseless == "quickassist.exe", "QuickAssist",
    process.name.caseless == "r_server.exe", "Radmin",
    process.name.caseless == "radmin.exe", "Radmin",
    process.name.caseless == "radmin3.exe", "Radmin",
    process.name.caseless == "rcengmgru.exe", "Rsupport",
    process.name.caseless == "rcclient.exe", "RPCSuite",
    process.name.caseless == "rcmgrsvc.exe", "Rsupport",
    process.name.caseless == "rcservice.exe", "RPCSuite",
    process.name.caseless == "remotedesktopmanager.exe", "Devolutions",
    process.name.caseless == "remotely_agent.exe", "Remotely",
    process.name.caseless == "remotely_desktop.exe", "Remotely",
    process.name.caseless == "remotepc.exe", "RemotePC",
    process.name.caseless == "remotepcdesktop.exe", "RemotePC",
    process.name.caseless == "remotepcservice.exe", "RemotePC",
    process.name.caseless == "remoteview.exe", "Rsupport",
    process.name.caseless == "rfusclient.exe", "RemoteUtilities",
    process.name.caseless == "rmm.agent.exe", "SuperOps",
    process.name.caseless == "romserver.exe", "RealVNC",
    process.name.caseless == "romviewer.exe", "RealVNC",
    process.name.caseless == "rpcsuite.exe", "RPCSuite",
    process.name.caseless == "rserver3.exe", "Radmin",
    process.name.caseless == "rustdesk.exe", "RustDesk",
    process.name.caseless == "rutserv.exe", "RemoteUtilities",
    process.name.caseless == "rutview.exe", "RemoteUtilities",
    process.name.caseless == "rvagent.exe", "Rsupport",
    process.name.caseless == "rvagtray.exe", "Rsupport",
    process.name.caseless == "saazapsc.exe", "Kaseya",
    process.name.caseless like "screenconnect*.exe", "ScreenConnect",
    process.name.caseless == "session_win.exe", "ZohoAssist",
    process.name.caseless == "simplegatewayservice.exe", "SimpleHelp",
    process.name.caseless == "simplehelpcustomer.exe", "SimpleHelp",
    process.name.caseless == "smpcview.exe", "Splashtop",
    process.name.caseless == "spclink.exe", "Splashtop",
    process.name.caseless == "splashtop-streamer.exe", "Splashtop",
    process.name.caseless == "splashtopsos.exe", "Splashtop",
    process.name.caseless == "spsrv.exe", "Splashtop",
    process.name.caseless == "sragent.exe", "Splashtop",
    process.name.caseless == "srservice.exe", "Splashtop",
    process.name.caseless == "srmanager.exe", "Splashtop",
    process.name.caseless == "srserver.exe", "Splashtop",
    process.name.caseless == "strwinclt.exe", "Splashtop",
    process.name.caseless == "supremo.exe", "Supremo",
    process.name.caseless == "supremoservice.exe", "Supremo",
    process.name.caseless == "syncro.app.runner.exe", "Splashtop",
    process.name.caseless == "syncro.installer.exe", "Splashtop",
    process.name.caseless == "syncro.overmind.service.exe", "Splashtop",
    process.name.caseless == "syncro.service.exe", "Splashtop",
    process.name.caseless == "syncrolive.agent.exe", "Splashtop",
    process.name.caseless == "syncrolive.agent.runner.exe", "Splashtop",
    process.name.caseless == "syncrolive.service.exe", "Splashtop",
    process.name.caseless == "tacticalrmm.exe", "TacticalRMM",
    process.name.caseless == "tailscale.exe", "Tailscale",
    process.name.caseless == "tailscaled.exe", "Tailscale",
    process.name.caseless == "teamviewer.exe", "TeamViewer",
    process.name.caseless == "teamviewer_desktop.exe", "TeamViewer",
    process.name.caseless == "teamviewer_service.exe", "TeamViewer",
    process.name.caseless == "tiagent.exe", "Tiflux",
    process.name.caseless == "ticlientcore.exe", "Tiflux",
    process.name.caseless == "todesk_service.exe", "ToDesk",
    process.name.caseless == "toolsiq.exe", "ToolsIQ",
    process.name.caseless == "tsclient.exe", "Techinline",
    process.name.caseless == "tvn.exe", "TightVNC",
    process.name.caseless == "tvnserver.exe", "TightVNC",
    process.name.caseless == "tvnviewer.exe", "TightVNC",
    process.name.caseless == "twingate.exe", "Twingate",
    process.name.caseless like "ultravnc*.exe", "UltraVNC",
    process.name.caseless like "ultraviewer*.exe", "UltraViewer",
    process.name.caseless == "velociraptor.exe", "Velociraptor",
    process.name.caseless == "vncserver.exe", "RealVNC",
    process.name.caseless == "vncviewer.exe", "RealVNC",
    process.name.caseless == "winvnc.exe", "RealVNC",
    process.name.caseless == "winwvc.exe", "TightVNC",
    process.name.caseless == "za_access.exe", "ZohoAssist",
    process.name.caseless == "za_connect.exe", "ZohoAssist",
    process.name.caseless == "zaservice.exe", "ZohoAssist",
    process.name.caseless == "zmagent.exe", "ZohoAssist",
    process.name.caseless == "zohomeeting.exe", "ZohoAssist",
    process.name.caseless == "zohotray.exe", "ZohoAssist",
    process.name.caseless == "zohours.exe", "ZohoAssist",
    process.name.caseless == "zohoursservice.exe", "ZohoAssist",
    ""
  )
| where Esql.rmm_vendor != "" and Esql.rmm_vendor is not NULL
| stats Esql.vendor_count = count_distinct(Esql.rmm_vendor),
        Esql.vendors_seen = values(Esql.rmm_vendor),
        Esql.processes_executable_values = values(process.executable),
        Esql.first_seen = min(@timestamp),
        Esql.last_seen = max(@timestamp)
  by host.name, host.id
| where Esql.vendor_count >= 2
| sort Esql.vendor_count desc
| keep host.id, host.name, Esql.*