OpenSec Atlas

LOLRMM: An Open Source Dataset for Threat Intelligence | OpenSec Atlas

Threat Intelligence

Dataset

LOLRMM

LOLRMM is a community-driven project that catalogs RMM tools potentially abused by threat actors for threat hunting and detection.

Visit Website View on GitHub

About This Tool

LotL RMM

Primary Use Case

LOLRMM is used by security professionals to stay informed about Remote Monitoring and Management tools that can be misused by threat actors. It aids in threat hunting, detection, and prevention policy creation by providing detailed information and detection methods for these tools.

Key Features

Comprehensive collection of historically abused RMM tools
Structured YAML files with detailed tool information
Integration with Sigma for detection rules
API access for data in JSON or CSV format
Detection methods including Sigma rules

Insights & Recommendations

Ensure Python 3.10, Poetry, and Node.js are installed before proceeding with local builds. Regularly check for updates and contribute to maintain the project's value.

Installation

Clone the repository: git clone https://github.com/magicsword-io/LOLRMM.git
Change to the project directory: cd LOLRMM
Install dependencies: poetry install
Activate the virtual environment: poetry shell
Build the site using the files under the /yaml folder: python bin/site.py
Change to the website directory and install dependencies: cd website && pnpm i
Run the website locally: pnpm dev

Usage

curl https://lolrmm.io/api/rmm_tools.json

Fetch the complete list of RMM tools in JSON format.

curl https://lolrmm.io/api/rmm_tools.csv

Fetch the complete list of RMM tools in CSV format.

Smart Usage Notes

Repurposing: While primarily a detection tool, LOLRMM can be used to train machine learning models to predict potential misuse of RMM tools based on historical data.
Chaining: Combine LOLRMM with a SIEM solution to automatically trigger alerts when suspicious RMM activity is detected, enhancing real-time threat detection capabilities.
Evasion/Detection: Attackers might use encrypted channels or obfuscation techniques to bypass detection. Implementing deep packet inspection and anomaly detection can help identify such evasion attempts.
Data Fusion: Integrate LOLRMM data with threat intelligence feeds to correlate known malicious IP addresses with RMM tool usage, providing a more comprehensive threat landscape view.
Automation: Develop automated scripts to regularly update detection rules in Sigma based on the latest LOLRMM data, ensuring SOC teams always have the most current threat information.