UEMS
UEMS Manage Engine Agent
- 2 paths
*.log- Per-user data
- Version 1
- Abdelkarim CHORFI - CERT CWATCH - ALMOND
Paths on disk
2 paths
Notes
UEMS Manage Engine Agent is a remote access tool in the ManageEngine suite.
We have observed this tool being deployed in a recent Cactus ransomware Campaign:
References
5 links
- manageengine.com/unified-endpoint-management-security.html(opens in new tab)
- arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/(opens in new tab)
- bleepingcomputer.com/news/security/cactus-ransomware-exploiting-qlik-sense-flaws-to-breach-networks/(opens in new tab)
- cybersecuritydive.com/news/cactus-ransomware-qlik-sense-cves/714578/(opens in new tab)
- linkedin.com/pulse/wheres-my-logs-uems-zoho-meeting-edition-geir-olav-skei-ua2rfv(opens in new tab)