Sigma rule: Potentially Suspicious File Creation by OpenEDR's ITSMService

Rule

Title

Potentially Suspicious File Creation by OpenEDR's ITSMService

Status

experimental

Level

medium

Author

@kostastsale

Date

2026-02-19

File

rules/windows/file/file_event/file_event_win_comodo_itsm_potentially_suspicious_file_creation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.

Log source

product

windows

category

file_event

Detection

selection_process:
    Image|endswith: '\COMODO\Endpoint Manager\ITSMService.exe'
selection_suspicious_extensions:
    TargetFilename|endswith:
        - '.7z'
        - '.bat'
        - '.cmd'
        - '.com'
        - '.dll'
        - '.exe'
        - '.hta'
        - '.js'
        - '.pif'
        - '.ps1'
        - '.rar'
        - '.scr'
        - '.vbe'
        - '.vbs'
        - '.zip'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate OpenEDR file management operations
• Authorized remote file uploads by IT administrators
• Software deployment through OpenEDR console

Tags

• attack.command-and-control
• attack.t1105
• attack.lateral-movement
• attack.t1570
• attack.t1219

MITRE ATT&CK ids this rule names

• T1105
• T1219
• T1570

References

• https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_comodo_itsm_potentially_suspicious_file_creation.yml