1.4 KiB
Cybertek Detection Scripts
Syncro RMM scripts used by Cybertek Systems for endpoint security monitoring. Each script runs on a schedule via Syncro and raises alerts when suspicious activity is detected.
Scripts
Network Traffic Monitor
network_traffic_monitor/network_traffic_monitor.ps1
Monitors active network connections for malicious IPs using live threat intelligence feeds (aggregated hourly from abuse.ch, Emerging Threats, and others). Raises a Syncro alert categorized as network_traffic_critical or network_traffic_warning depending on threat severity.
LoLRMM Detector
lolrmm/lolrmm_syncro_detector.ps1
Detects unauthorized Remote Monitoring and Management (RMM) tools running on endpoints. Checks running processes and installed software against the lolrmm.io database of known RMM tools. Raises a Syncro alert if any unapproved RMM tool is found.
Event Log Monitor
event_log_monitoring/event_log_monitor.ps1
Monitors the Windows Security Event Log for high-value security events — including failed logon attempts, privilege escalation, account lockouts, and suspicious process activity. Raises Syncro alerts categorized by severity.
Deployment
All scripts are deployed and scheduled via Syncro RMM. Each script is self-contained and requires only a Syncro API key configured as a Script Variable within the Syncro platform.