Rule Info
Name
Suspicious Child Processes Spawned by Splashtop
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects suspicious child processes spawned by Splashtop process. This could indicate the presence of a remote management tool (RMM) or remote access tool (RAT) on the system.
Threat actors may use these tools to gain unauthorized access to systems and networks and perform malicious activities.
Reference
Internal Research
Date
2026-02-11 00:00:00
Modified
None
Id
46d19fd4-fa7c-4abb-9d6d-a49474274d30
Tags
attack.command-and-control attack.t1219.002
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR