ARO: Tools for Remote Administration Detected on your Network

Remote Administration tools are a useful method of managing hosts that you cannot physically access. However, if you don't secure them properly, threat actors can use them to access hosts and your network through your threat surface.

This alert is highlighting you have remote administration tools within your network and where they are installed.

You can use these AROs to review what tools we have detected and take action to secure or query why they exist.

Dismissing this ARO will prevent future alerts for ANY host that has the specified remote administration tool installed. Field Effect still alerts if it detects a different remote administration tool, regardless of which host it finds it on.

Resolve this ARO if you expect changes to this activity (for example, you plan to add the tool to other hosts).  Field Effect will generate a new ARO of the same type with an updated overview of the remote administration tools installed in your environment.