{"id":208583,"date":"2024-02-23T13:10:09","date_gmt":"2024-02-23T13:10:09","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/fernzugriffs-software-erkennen-powershell\/"},"modified":"2024-03-05T16:40:04","modified_gmt":"2024-03-05T16:40:04","slug":"fernzugriffs-software-erkennen-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/de\/script-hub\/fernzugriffs-software-erkennen-powershell\/","title":{"rendered":"Erkennen von Fernzugriffs-Software auf einem System mithilfe von PowerShell"},"content":{"rendered":"<p>Mit der zunehmenden Verbreitung von Remote-Arbeitspl\u00e4tzen und der weit verbreiteten Nutzung von Cloud-Technologien ist die Gew\u00e4hrleistung der Sicherheit von Endpunkten f\u00fcr IT-Experten auf der ganzen Welt von gr\u00f6\u00dfter Bedeutung. Die <strong>Erkennung von Fernzugriffs-Software<\/strong> ist ein wachsendes Problem, da sie oft der Einstiegspunkt f\u00fcr b\u00f6sartige Entit\u00e4ten sein kann.<\/p>\n<h2>Hintergrund<\/h2>\n<p>Remote Access Tools (RATs) gibt es schon seit geraumer Zeit. Sie k\u00f6nnen zwar bei der Fehlersuche und bei administrativen Aufgaben aus der Ferne von gro\u00dfem Nutzen sein, k\u00f6nnen aber auch von Cyber-Angreifern ausgenutzt werden, um sich unbefugten Zugang zu Systemen zu verschaffen. F\u00fcr IT-Experten und <a href=\"https:\/\/www.ninjaone.com\/de\/was-ist-ein-msp\/\">Managed Service Provider (MSPs)<\/a> ist es wichtig zu wissen, wie man diese Tools auf einem System erkennt. Sie dienen als erste Verteidigungslinie gegen potenzielle Sicherheitsverletzungen und unbefugten Datenzugriff.<\/p>\n<h2>Das Skript:<\/h2>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"powershell\">#Requires -Version 5.1\r\n\r\n&lt;#\r\n.SYNOPSIS\r\n    This script will look for remote access tools installed on the system. It can be given a list of tools to ignore as well as grab the exclusion list from a designated custom field.\r\n    \r\n    DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n.DESCRIPTION\r\n    This script will look for remote access tools installed on the system. Below is the full list of tools. Please note you can give it a list of tools to ignore and you can have\r\n    it grab the list from a custom field of your choosing.\r\n\r\n    DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n\r\n    Remote Tools: AeroAdmin, Ammyy Admin, AnyDesk, BeyondTrust, Chrome Remote Desktop, Connectwise Control, DWService, GoToMyPC, LiteManager, LogMeIn, ManageEngine,\r\n    NoMachine, Parsec, Remote Utilities, RemotePC, Splashtop, Supremo, TeamViewer, TightVNC, UltraVNC, VNC Connect (RealVNC), Zoho Assist\r\n    RMM's: Atera, Automate, Datto RMM, Kaseya, N-Able N-Central, N-Able N-Sight, Syncro\r\n\r\n.EXAMPLE\r\n    (No Parameters)\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ExcludeTools \"Chrome Remote Desktop,Connectwise Control\"\r\n    A comma seperated list of tools you'd like to exclude from alerting on.\r\n.EXAMPLE\r\n    -ExcludeTools \"Chrome Remote Desktop,Connectwise Control\"\r\n    We couldn't find any active remote access tools!\r\n\r\nPARAMETER: -ExclusionsFromCustomField \"ReplaceMeWithAnyTextCustomField\"\r\n    The name of a custom field that contains a comma seperated list of tools to exclude from alerting. ex. \"ApprovedRemoteTools\"\r\n.EXAMPLE\r\n    -ExclusionsFromCustomField \"ReplaceMeWithAnyTextCustomField\"\r\n    We couldn't find any active remote access tools!\r\n\r\nPARAMETER: -ExportCSV \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    The name of a multiline custom field to export to in csv format. ex. \"RemoteTools\"\r\n.EXAMPLE\r\n    -ExportCSV \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ExportJSON \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    The name of a multiline custom field to export to in JSON format. ex. \"RemoteTools\"\r\n.EXAMPLE\r\n    -ExportJSON \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ShowNotFound\r\n    Show the tools the script did not find as well.\r\n.EXAMPLE\r\n    -ShowNotFound\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    AeroAdmin               No                  No\r\n    Ammyy Admin             No                  No\r\n    BeyondTrust             No                  No\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n    \r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    General notes: CustomFields must be multiline for export. Regular text is fine for ExclusionsFromCustomField\r\n    Release notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#&gt;\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$ExcludeTools,\r\n    [Parameter()]\r\n    [String]$ExclusionsFromCustomField,\r\n    [Parameter()]\r\n    [String]$ExportCSV,\r\n    [Parameter()]\r\n    [String]$ExportJSON,\r\n    [Parameter()]\r\n    [Switch]$ShowNotFound\r\n    &lt;#\r\n        ## ParameterName Requirement DefaultValue Type Options Description ##\r\n        ExcludeTools Optional none TEXT Comma seperated list of tools you would not like to look for.\r\n        ExclusionsFromCustomField Optional none TEXT Name of custom field you would like to grab exclusions from.\r\n        ExportCSV Optional none TEXT Name of multi-line custom field you would like to export results to. It will export them in csv format.\r\n        ExportJSON Optional none TEXT Name of multi-line custom field you would like to export results to. It will export them in json format.\r\n        ShowNotFound Optional false CHECKBOX Show results even if it didn't find that specific tool.\r\n    #&gt;\r\n)\r\n\r\nbegin {\r\n    #DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    #Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n\r\n    # Check's the two Uninstall registry keys to see if the app is installed. Needs the name as it would appear in Control Panel.\r\n    function Find-UninstallKey {\r\n        [CmdletBinding()]\r\n        param (\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$DisplayName,\r\n            [Parameter()]\r\n            [Switch]$UninstallString\r\n        )\r\n        process {\r\n            $UninstallList = New-Object System.Collections.Generic.List[Object]\r\n\r\n            $Result = Get-ChildItem HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall* | Get-ItemProperty | \r\n            Where-Object { $_.DisplayName -like \"*$DisplayName*\" }\r\n\r\n            if($Result){ $UninstallList.Add($Result) }\r\n\r\n            $Result = Get-ChildItem HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall* | Get-ItemProperty | \r\n            Where-Object { $_.DisplayName -like \"*$DisplayName*\" }\r\n\r\n            if($Result){ $UninstallList.Add($Result) }\r\n\r\n            # Programs don't always have an uninstall string listed here so to account for that I made this optional.\r\n            if ($UninstallString) {\r\n                # 64 Bit\r\n                $UninstallList | Select-Object -ExpandProperty UninstallString -ErrorAction Ignore\r\n            }\r\n            else {\r\n                $UninstallList\r\n            }\r\n        }\r\n    }\r\n\r\n    # This will see if the process is currently active. Some people may want to react sooner to these alerts if its currently running vs not.\r\n    function Find-Process {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Name\r\n        )\r\n        process {\r\n            Get-Process | Where-Object { $_.ProcessName -like \"*$Name*\" } | Select-Object -ExpandProperty Name\r\n        }\r\n    }\r\n\r\n    # This will search C:ProgramFiles and C:ProgramFiles(x86) for the executable these tools use to run.\r\n    function Find-Executable {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Path,\r\n            [Parameter()]\r\n            [Switch]$Special\r\n        )\r\n        process {\r\n            if(!$Special){\r\n                if (Test-Path \"$env:ProgramFiles$Path\") {\r\n                    \"$env:ProgramFiles$Path\"\r\n                }\r\n        \r\n                if (Test-Path \"${Env:ProgramFiles(x86)}$Path\") {\r\n                    \"${Env:ProgramFiles(x86)}$Path\"\r\n                }\r\n    \r\n                if (Test-Path \"$env:ProgramData$Path\") {\r\n                    \"$env:ProgramData$Path\"\r\n                }\r\n            }else{\r\n                if(Test-Path $Path){\r\n                    $Path\r\n                }\r\n            }\r\n        }\r\n    }\r\n\r\n    # Brought Get-CimInstance outside the function for better performance.\r\n\r\n    $ServiceList = Get-CimInstance win32_service\r\n    function Find-Service {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Name\r\n        )\r\n        process {\r\n            # Get-Service will display an error everytime it has an issue reading a service. Ignoring them as they're not relevant.\r\n            $ServiceList | Where-Object {$_.State -notlike \"Disabled\" -and $_.State -notlike \"Stopped\"} | \r\n            Where-Object {$_.PathName -Like \"*$Name.exe*\"}\r\n        }\r\n    }\r\n\r\n    function Export-CustomField {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter()]\r\n            [String]$Name,\r\n            [Parameter()]\r\n            [ValidateSet(\"csv\", \"json\")]\r\n            [String]$Format,\r\n            [Parameter()]\r\n            [PSCustomObject]$Object\r\n        )\r\n        if ($Format -eq \"csv\") {\r\n            $csv = $Object | ConvertTo-Csv -NoTypeInformation | Out-String\r\n            Ninja-Property-Set $Name $csv\r\n        }\r\n        else {\r\n            $json = $Object | ConvertTo-Json | Out-String\r\n            Ninja-Property-Set $Name $json\r\n        }\r\n    }\r\n\r\n    # This define's what tools we're looking for and how the script can find them. Some don't actually install anywhere (portable app) others do. \r\n    # Some change their installation path everytime so not particularly worth it to find it that way.\r\n    # Others store themselves in a super weird directory. Many don't list exactly where there .exe file is stored and suggest you exclude the whole folder from the av.\r\n    $RemoteToolList = @(\r\n        [PSCustomObject]@{Name = \"AeroAdmin\"; ProcessName = \"AeroAdmin\" }\r\n        [PSCustomObject]@{Name = \"Ammyy Admin\"; ProcessName = \"AA_v3\" }\r\n        [PSCustomObject]@{Name = \"AnyDesk\"; DisplayName = \"AnyDesk\"; ProcessName = \"AnyDesk\"; ExecutablePath = \"AnyDeskAnyDesk.exe\" }\r\n        [PSCustomObject]@{Name = \"BeyondTrust\"; DisplayName = \"Remote Support Jump Client\", \"Jumpoint\"; ProcessName = \"bomgar-jpt\" }\r\n        [PSCustomObject]@{Name = \"Chrome Remote Desktop\"; DisplayName = \"Chrome Remote Desktop Host\"; ProcessName = \"remoting_host\"; ExecutablePath = \"GoogleChrome Remote Desktop112.0.5615.26remoting_host.exe\" }\r\n        [PSCustomObject]@{Name = \"Connectwise Control\"; DisplayName = \"ScreenConnect Client\"; ProcessName = \"ScreenConnect.ClientService\" }\r\n        [PSCustomObject]@{Name = \"DWService\"; DisplayName = \"DWAgent\"; ProcessName = \"dwagent\",\"dwagsvc\"; ExecutablePath = \"DWAgentruntimedwagent.exe\" }\r\n        [PSCustomObject]@{Name = \"GoToMyPC\"; DisplayName = \"GoToMyPC\"; ProcessName = \"g2comm\", \"g2pre\", \"g2svc\", \"g2tray\"; ExecutablePath = \"GoToMyPCg2comm.exe\", \"GoToMyPCg2pre.exe\", \"GoToMyPCg2svc.exe\", \"GoToMyPCg2tray.exe\" }\r\n        [PSCustomObject]@{Name = \"LiteManager\"; DisplayName = \"LiteManager Pro - Server\"; ProcessName = \"ROMServer\", \"ROMFUSClient\"; ExecutablePath = \"LiteManager Pro - ServerROMFUSClient.exe\", \"LiteManager Pro - ServerROMServer.exe\" }\r\n        [PSCustomObject]@{Name = \"LogMeIn\"; DisplayName = \"LogMeIn\"; ProcessName = \"LogMeIn\"; ExecutablePath = \"LogMeInx64LogMeIn.exe\", \"LogMeInx64LogMeInSystray.exe\" }\r\n        [PSCustomObject]@{Name = \"ManageEngine\"; DisplayName = \"ManageEngine Remote Access Plus - Server\", \"ManageEngine UEMS - Agent\"; ProcessName = \"dcagenttrayicon\", \"UEMS\", \"dcagentservice\"; ExecutablePath = \"UEMS_Agentbindcagenttrayicon.exe\", \"UEMS_CentralServerbinUEMS.exe\", \"UEMS_Agentbindcagentservice.exe\" }\r\n        [PSCustomObject]@{Name = \"NoMachine\"; DisplayName = \"NoMachine\"; ProcessName = \"nxd\", \"nxnode.bin\", \"nxserver.bin\", \"nxservice64\"; ExecutablePath = \"NoMachinebinnxd.exe\", \"NoMachinebinnxnode.bin\", \"NoMachinebinnxserver.bin\", \"NoMachinebinnxservice64.exe\" }\r\n        [PSCustomObject]@{Name = \"Parsec\"; DisplayName = \"Parsec\"; ProcessName = \"parsecd\", \"pservice\"; ExecutablePath = \"Parsecparsecd.exe\", \"Parsecpservice.exe\" }\r\n        [PSCustomObject]@{Name = \"Remote Utilities\"; DisplayName = \"Remote Utilities - Host\"; ProcessName = \"rutserv\", \"rfusclient\"; ExecutablePath = \"Remote Utilities - Hostrfusclient.exe\" }\r\n        [PSCustomObject]@{Name = \"RemotePC\"; DisplayName = \"RemotePC\"; ProcessName = \"RemotePCHostUI\",\"RPCPerformanceService\"; ExecutablePath = \"RemotePC HostRemotePCHostUI.exe\", \"RemotePC HostRemotePCPerformanceRPCPerformanceService.exe\" }\r\n        [PSCustomObject]@{Name = \"Splashtop\"; DisplayName = \"Splashtop Streamer\"; ProcessName = \"SRAgent\", \"SRAppPB\", \"SRFeature\", \"SRManager\", \"SRService\"; ExecutablePath = \"SplashtopSplashtop RemoteServerSRService.exe\" }\r\n        [PSCustomObject]@{Name = \"Supremo\"; ProcessName = \"Supremo\", \"SupremoHelper\", \"SupremoService\"; ExecutablePath = \"SupremoSupremoService.exe\" }\r\n        [PSCustomObject]@{Name = \"TeamViewer\"; DisplayName = \"TeamViewer\"; ProcessName = \"TeamViewer\", \"TeamViewer_Service\", \"tv_w32\", \"tv_x64\"; ExecutablePath = \"TeamViewerTeamViewer.exe\", \"TeamViewerTeamViewer_Service.exe\", \"TeamViewertv_w32.exe\", \"TeamViewertv_x64.exe\" }\r\n        [PSCustomObject]@{Name = \"TightVNC\"; DisplayName = \"TightVNC\"; ProcessName = \"tvnserver\"; ExecutablePath = \"TightVNCtvnserver.exe\" }\r\n        [PSCustomObject]@{Name = \"UltraVNC\"; DisplayName = \"UltraVNC\"; ProcessName = \"winvnc\"; ExecutablePath = \"uvnc bvbaUltraVNCWinVNC.exe\" }\r\n        [PSCustomObject]@{Name = \"VNC Connect (RealVNC)\"; DisplayName = \"VNC Server\"; ProcessName = \"vncserver\"; ExecutablePath = \"RealVNCVNC Servervncserver.exe\" }\r\n        [PSCustomObject]@{Name = \"Zoho Assist\"; DisplayName = \"Zoho Assist Unattended Agent\"; ProcessName = \"ZohoURS\", \"ZohoURSService\"; ExecutablePath = \"ZohoMeetingUnAttendedZohoMeetingZohoURS.exe\", \"ZohoMeetingUnAttendedZohoMeetingZohoURSService.exe\" }\r\n        [PSCustomObject]@{Name = \"Atera\"; DisplayName = \"AteraAgent\"; ProcessName = \"AteraAgent\"; ExecutablePath = \"ATERA NetworksAteraAgentAteraAgent.exe\"}\r\n        [PSCustomObject]@{Name = \"Automate\"; DisplayName = \"Connectwise Automate\"; ProcessName = \"LTService\", \"LabTechService\"; SpecialExecutablePath = \"C:WindowsLTSvcLTSvc.exe\"}\r\n        [PSCustomObject]@{Name = \"Datto RMM\"; DisplayName = \"Datto RMM\"; ProcessName = \"AEMAgent\"; ExecutablePath = \"CentraStageAEMAgentAEMAgent.exe\", \"CentraStagegui.exe\"}\r\n        [PSCustomObject]@{Name = \"Kaseya\"; DisplayName = \"Kaseya Agent\"; ProcessName = \"AgentMon\", \"KaseyaRemoteControlHost\", \"Kasaya.AgentEndpoint\"; ExecutablePath = \"KaseyaAgentMonAgentMon.exe\"}\r\n        [PSCustomObject]@{Name = \"N-Able N-Central\"; DisplayName = \"Windows Agent\"; ProcessName = \"winagent\"; ExecutablePath = \"N-able TechnologiesWindows Agentwinagent.exe\"}\r\n        [PSCustomObject]@{Name = \"N-Able N-Sight\"; DisplayName = \"Advanced Monitoring Agent\"; ProcessName = \"winagent\"; ExecutablePath = \"Advanced Monitoring Agentwinagent.exe\", \"Advanced Monitoring Agent GPwinagent.exe\"}\r\n        [PSCustomObject]@{Name = \"Syncro\"; DisplayName = \"Syncro\",\"Kabuto\"; ProcessName = \"Syncro.App.Runner\", \"Kabuto.App.Runner\", \"Syncro.Service.Runner\", \"Kabuto.Service.Runner\", \"SyncroLive.Agent.Runner\", \"Kabuto.Agent.Runner\", \"SyncroLive.Agent.Service\", \"Syncro.Access.Service\", \"Syncro.Access.App\"; ExecutablePath = \"RepairTechSyncroSyncro.Service.Runner.exe\", \"RepairTechSyncroSyncro.App.Runner.exe\"}\r\n    )\r\n}\r\nprocess {\r\n\r\n    # Lets see what tools we don't want to alert on.\r\n    $ExcludedTools = New-Object System.Collections.Generic.List[String]\r\n\r\n    if ($ExcludeTools) {\r\n        $ExcludedTools.Add(($ExcludeTools.split(',')).Trim())\r\n    }\r\n\r\n    # Grabs the info we need from a textbox.\r\n    if ($env:ExcludeTools) {\r\n        $ExcludedTools.Add($env:ExcludeTools.split(','))\r\n    }\r\n\r\n    # For this kind of alert it might be worth it to create a whole custom field of ignorables.\r\n    if ($ExclusionsFromCustomField) {\r\n        $ExcludedTools.Add((Ninja-Property-Get $ExclusionsFromCustomField -split(',')).trim())\r\n    }\r\n\r\n    if ($env:ExclusionsFromCustomField) {\r\n        $ExcludedTools.Add((Ninja-Property-Get $env:ExclusionsFromCustomField -split(',')).trim())\r\n    }\r\n\r\n    if ($ExportCSV -or $Env:ExportCSV) {\r\n        $Format = \"csv\"\r\n\r\n        if ($ExportCSV) {\r\n            $ExportResults = $ExportCSV\r\n        }\r\n\r\n        if ($env:ExportCSV) {\r\n            $ExportResults = $env:ExportCSV\r\n        }\r\n    }elseif ($ExportJSON -or $env:ExportJSON) {\r\n        $Format = \"json\"\r\n\r\n        if ($ExportJSON) {\r\n            $ExportResults = $ExportJSON\r\n        }\r\n\r\n        if ($env:ExportJSON) {\r\n            $ExportResults = $env:ExportJSON\r\n        }\r\n    }\r\n\r\n    # This take's our list and begins searching by the 4 method's in the begin block. \r\n    $RemoteAccessTools = $RemoteToolList | ForEach-Object {\r\n\r\n        $UninstallKey = if ($_.DisplayName) {\r\n            $_.DisplayName | Find-UninstallKey\r\n        }\r\n        \r\n        $UninstallInfo = if ($_.DisplayName) {\r\n            $_.DisplayName | Find-UninstallKey -UninstallString\r\n        }\r\n        \r\n        $RunningStatus = if ($_.ProcessName) {\r\n            $_.ProcessName | Find-Process\r\n        }\r\n\r\n        $ServiceStatus = if($_.ProcessName) {\r\n            $_.ProcessName | Find-Service\r\n        }\r\n        \r\n        $InstallPath = if ($_.ExecutablePath) {\r\n            $_.ExecutablePath | Find-Executable\r\n        }elseif($_.SpecialExecutablePath){\r\n            $_.SpecialExecutablePath | Find-Executable -Special\r\n        }\r\n\r\n        if ($UninstallKey -or $RunningStatus -or $InstallPath -or $ServiceStatus) {\r\n            $Installed = \"Yes\"\r\n        }\r\n        else {\r\n            $Installed = \"No\"\r\n        }\r\n\r\n        [PSCustomObject]@{\r\n            Name              = $_.Name\r\n            Installed         = $Installed\r\n            CurrentlyRunning  = if ($RunningStatus) { \"Yes\" }else { \"No\" }\r\n            HasRunningService = if ($ServiceStatus) { \"Yes\" }else { \"No\" }\r\n            UninstallString   = $UninstallInfo\r\n            ExePath           = $InstallPath\r\n        } | Where-Object { $ExcludedTools -notcontains $_.Name }\r\n    }\r\n\r\n    $ActiveRemoteAccessTools = $RemoteAccessTools | Where-Object {$_.Installed -eq \"Yes\"}\r\n\r\n    # If we found anything in the three check's we're gonna indicate it's installed but we may also want to save our results to a custom field.\r\n    # We also may want to output more than \"We couldn't find any active remote access tools!\" in the event we find nothing.\r\n    if ($ShowNotFound -or $env:ShowNotFound) {\r\n\r\n        $RemoteAccessTools | Format-Table -Property Name, Installed, CurrentlyRunning, HasRunningService, UninstallString -AutoSize -Wrap | Out-String | Write-Host\r\n\r\n        if($ExportResults){\r\n            Export-CustomField -Name $ExportResults -Format $Format -Object ($RemoteAccessTools | Select-Object Name, Installed, CurrentlyRunning, HasRunningService)\r\n        }\r\n\r\n    }else{\r\n        if($ActiveRemoteAccessTools){\r\n\r\n            $ActiveRemoteAccessTools | Format-Table -Property Name, CurrentlyRunning, HasRunningService, UninstallString -AutoSize -Wrap | Out-String | Write-Host\r\n\r\n            if($ExportResults){\r\n                Export-CustomField -Name $ExportResults -Format $Format -Object ($ActiveRemoteAccessTools | Select-Object Name, CurrentlyRunning, HasRunningService)\r\n            }\r\n\r\n        }else{\r\n            Write-Host \"We couldn't find any active remote access tools!\"\r\n        }\r\n    }\r\n\r\n    if($ActiveRemoteAccessTools){\r\n        # We're going to set a failure status code in the event that we find something.\r\n        exit 1\r\n    }\r\n    else {\r\n        exit 0\r\n    }\r\n}<\/pre>\n<p>&nbsp;<\/p>\n\n<div class=\"in-context-cta\"><p style=\"text-align: center;\">Zugriff auf \u00fcber 300 Skripte im NinjaOne Dojo<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.ninjaone.com\/de\/kostenlosetestversionformular\/\">Zugang erhalten<\/a><\/p>\n<\/div>\n<h2>Detailansicht<\/h2>\n<p>Die Erkennung von Fernzugriffs-Software umfasst einige wichtige Schritte:<\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><strong>\u00dcberwachung des Netzwerkverkehrs<\/strong>: Beginnen Sie mit der \u00dcberwachung des Netzwerkverkehrs. Ungew\u00f6hnliche Muster oder unbekannte IP-Adressen k\u00f6nnen ein Hinweis sein.<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><strong>Systemprozesse und -aufgaben<\/strong>: Die regelm\u00e4\u00dfige \u00dcberpr\u00fcfung aktiver Systemprozesse kann dabei helfen, nicht autorisierte Tools zu identifizieren. Jeder ungew\u00f6hnliche Prozess erfordert weitere Untersuchungen.<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><strong>Software-Audit<\/strong>: Mit integrierten Systemwerkzeugen wie dem &#8222;Task-Manager&#8220; f\u00fcr Windows oder dem &#8222;Aktivit\u00e4tsmonitor&#8220; f\u00fcr macOS kann man eine Liste aller installierten Anwendungen erhalten. Die Suche nach unbekannter Software kann manchmal das Vorhandensein von Fernzugriffs-Tools preisgeben.<\/li>\n<\/ul>\n<h2>Potenzielle Anwendungsf\u00e4lle<\/h2>\n<p>Nehmen wir Alex, eine IT-Fachfrau in einem mittelst\u00e4ndischen Unternehmen. Sie stellt fest, dass die Netzwerkbandbreite w\u00e4hrend der arbeitsfreien Zeit stark ansteigt. Bei weiteren Untersuchungen stellt sie fest, dass eine unbekannte IP-Adresse st\u00e4ndig auf ihr Netzwerk zugreift. Mit Hilfe von System-Audit-Tools entdeckt sie eine Fernzugriffs-Software, die auf mehreren B\u00fcrosystemen installiert ist und an deren Installation sich niemand erinnern kann. Indem sie diese Software identifizierte und entfernte, vereitelte Alex eine m\u00f6gliche Datenverletzung.<\/p>\n<h2>Vergleiche<\/h2>\n<p>Herk\u00f6mmliche Methoden zur Erkennung von Fernzugriffs-Tools umfassen manuelle Audits, die \u00dcberpr\u00fcfung von Firewall-Protokollen oder die Verwendung von Antiviren-Software. Diese Methoden k\u00f6nnen zwar wirksam sein, aber sie sind nicht narrensicher. Der Ansatz des Skripts automatisiert den Erkennungsprozess und macht ihn sowohl umfassend als auch zeitsparend. Mit dieser proaktiven Methode k\u00f6nnen h\u00e4ufig neuere, ausgefeiltere RATs abgefangen werden, die mit herk\u00f6mmlichen Methoden umgangen werden k\u00f6nnten.<\/p>\n<h2>FAQs<\/h2>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><strong>Wie oft sollte ich einen Check auf Fernzugriffs-Tools durchf\u00fchren?<\/strong><br \/>\nRegelm\u00e4\u00dfig, besonders wenn Sie in einer Umgebung arbeiten, in der h\u00e4ufig neue Software installiert und getestet wird.<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><strong>Kann diese Erkennungsmethode alle Fernzugriffs-Software identifizieren?<\/strong><br \/>\nSie ist zwar umfassend, aber keine Methode ist zu 100 % sicher. Es ist von entscheidender Bedeutung, mehrere Ans\u00e4tze zu kombinieren, um robuste Sicherheit zu gew\u00e4hrleisten.<\/li>\n<\/ul>\n<div class=\"in-context-cta\"><h2>Gavin&#8217;s Meinung<\/h2>\n<p style=\"text-align: left;\">Die F\u00e4higkeit, zu erkennen, wenn nicht zugelassene Fernzugriffs-Software auf einem Computer installiert wird, ist entscheidend f\u00fcr die Sicherheit der Ger\u00e4te, des gesamten Netzwerks und der Daten Ihres Unternehmens.<\/p>\n<p style=\"text-align: left;\"><a href=\"https:\/\/www.ninjaone.com\/blog\/what-is-shadow-it\/\">Schatten-IT<\/a> bezieht sich auf Systeme, Ger\u00e4te, Software oder Anwendungen, die au\u00dferhalb des offiziellen Zust\u00e4ndigkeitsbereichs der IT-Abteilung Ihres Unternehmens verwendet und verwaltet werden. Dies ist in der Regel der Fall, wenn Mitarbeiter eigene Programme oder Technologien ohne ausdr\u00fcckliche Genehmigung oder Aufsicht verwenden. In diesem Fall ist jede Fernzugriffs-Software, die ohne Wissen der Organisation installiert wird, ein Beispiel f\u00fcr Schatten-IT. Wenn dies geschieht, ergeben sich mehrere kritische Herausforderungen:<\/p>\n<ul>\n<li><strong>Fehlende Aufsicht durch die IT-Abteilung: <\/strong>Wenn Fernzugriffs-Software unwissentlich auf einem oder mehreren Ger\u00e4ten installiert wird, umgeht sie h\u00e4ufig die Standardprotokolle f\u00fcr Sicherheit, Datenaufsicht und Compliance, die im Unternehmen eingerichtet sind.<\/li>\n<li><strong>Sicherheitsrisiken: <\/strong>Da die Fernzugriffs-Software nicht denselben Sicherheitsma\u00dfnahmen unterliegt wie autorisierte IT-Ressourcen, kann sie Schwachstellen aufweisen (die IT-Abteilung kann keine Software patchen, von der sie nichts wei\u00df), die m\u00f6glicherweise zu Datenverletzungen oder Sicherheitsvorf\u00e4llen f\u00fchren k\u00f6nnen<\/li>\n<li><strong>Anbieterrisiko: <\/strong>Einige Anbieter haben bessere Sicherheitsebenen als andere. Die Einf\u00fchrung von Software, insbesondere von Fernzugriffs-Software, deren Anbieter nicht angemessen gepr\u00fcft wurde, kann zus\u00e4tzliche Risiken f\u00fcr das Unternehmen mit sich bringen und sogar das Risiko bergen, dass Ihr Unternehmen bei Compliance- oder Sicherheitsbewertungen durchf\u00e4llt<\/li>\n<\/ul>\n<p style=\"text-align: left;\">Dieses Skript kann helfen, indem es aus einer Liste <a href=\"https:\/\/www.ninjaone.com\/de\/fernzugriff\">Fernzugriffs-Software<\/a> erkennt, und eingreift, wenn es etwas erkennt, das nicht in der autorisierten Liste enthalten ist. Neben den Sicherheitsaspekten bietet diese Art der Erkennung noch weitere Vorteile:<\/p>\n<div class=\"elementToProof\">\n<ul>\n<li>F\u00fcr MSPs kann dies ein fr\u00fches Anzeichen daf\u00fcr sein, dass Ihr Kunde sich an einen anderen MSP oder ein anderes IT-Unternehmen wendet<\/li>\n<li>Es kann helfen, \u00dcberbleibsel alter Fernzugriffs-Software zu identifizieren, die im Netzwerk installiert ist<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Abschlie\u00dfende \u00dcberlegungen<\/h2>\n<p>Unentdeckte <a href=\"https:\/\/www.ninjaone.com\/de\/fernzugriff\/\">Fernzugriffs-Software<\/a> kann zu erheblichen Sicherheitsverletzungen, Datendiebstahl oder sogar <a href=\"https:\/\/www.ninjaone.com\/de\/blog\/ransomware-erkennen\/\">Ransomware-Angriffen<\/a>f\u00fchren. Da immer mehr Unternehmen online gehen, wird die Gew\u00e4hrleistung der Sicherheit aller Endpunkte zu einer grundlegenden Aufgabe. Wird dies nicht ernst genommen, kann dies finanzielle, betriebliche und rufsch\u00e4digende Auswirkungen haben.<\/p>\n","protected":false},"author":35,"featured_media":143983,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[],"use_cases":[4280],"class_list":["post-208583","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","use_cases-system-konfiguration"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/script_hub\/208583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/comments?post=208583"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/media\/143983"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/media?parent=208583"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/operating_system?post=208583"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/de\/wp-json\/wp\/v2\/use_cases?post=208583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}