identifiers for remote and gmremote

Hunt Hypothesis

This detection rule identifies authentication events involving the “Remote” and “GMRemote” service accounts to uncover potential lateral movement or unauthorized administrative access within the Azure environment. Proactively hunting for these identifiers allows the SOC team to establish a baseline of legitimate service behavior and quickly detect anomalies that may indicate compromised credentials or privilege escalation attempts.

YARA Rule

rule RSharedStrings : Surtr Family {
	meta:
		description = "identifiers for remote and gmremote"
		author = "Katie Kleemola"
		last_updated = "07-21-2014"
	
	strings:
		$ = "nView_DiskLoydb" wide
		$ = "nView_KeyLoydb" wide
		$ = "nView_skins" wide
		$ = "UsbLoydb" wide
		$ = "%sBurn%s" wide
		$ = "soul" wide

	condition:
		any of them

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “identifiers for remote and gmremote” detection rule in an enterprise environment, along with targeted exclusion strategies:

• Scheduled Group Policy Updates via GPO

  • Scenario: The System Center Configuration Manager (SCCM) or native Windows Task Scheduler triggers a nightly job to push new security policies. This process utilizes the gpupdate command and invokes remote execution services (RemoteRegistry, WinRM) under the context of the Domain Admin group, generating high volumes of “remote” and “gmremote” identifiers that mimic unauthorized access attempts.
  • Filter/Exclusion: Create a rule exclusion for source IP ranges belonging to the SCCM site servers (e.g., 10.20.30.0/24) and restrict the alert trigger to non-business hours (01:00 – 05:00) when these scheduled GPO refreshes occur.

• Microsoft Endpoint Configuration Manager (MECM) Software Deployment

  • Scenario: During a major patch Tuesday deployment, MECM agents on thousands of endpoints initiate remote sessions to download and install updates. The deployment engine uses the gmremote identifier to manage group membership changes for software distribution points, causing legitimate spikes in detection logic that resemble lateral movement or privilege escalation attacks.
  • Filter/Exclusion: Exclude process names specifically associated with MECM agents (e.g., ccmexec.exe, WuaUla) and filter out events where the user account is a dedicated service account like svc-mecm-deploy rather than an interactive human user.

• Active Directory Administrative Center (ADAC) Bulk Operations

  • Scenario: Identity Management teams perform bulk user provisioning or attribute updates using PowerShell scripts executed via the Active Directory Administrative Center. These scripts often leverage remote PowerShell sessions (`Enter-PSSession