{"id":240926,"date":"2024-04-23T12:33:52","date_gmt":"2024-04-23T12:33:52","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&#038;p=240926"},"modified":"2024-04-23T12:44:41","modified_gmt":"2024-04-23T12:44:41","slug":"detectar-software-de-acceso-remoto","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/es\/script-hub\/detectar-software-de-acceso-remoto\/","title":{"rendered":"C\u00f3mo detectar software de acceso remoto en un sistema con PowerShell"},"content":{"rendered":"<p>Con el auge del trabajo a distancia y la adopci\u00f3n generalizada de tecnolog\u00edas en la nube, garantizar la seguridad de los endpoints se ha convertido en algo primordial para los profesionales de TI de todo el mundo. Poder <strong>detectar software de acceso remoto<\/strong> es una preocupaci\u00f3n creciente, ya que a menudo puede ser el punto de entrada de entidades maliciosas.<\/p>\n<h2>Antecedentes<\/h2>\n<p>Las herramientas de acceso remoto (RAT) existen desde hace tiempo y, aunque pueden ser extremadamente beneficiosas para la resoluci\u00f3n remota de problemas y tareas administrativas, tambi\u00e9n pueden ser explotadas por ciberadversarios para obtener acceso no autorizado a los sistemas. Comprender c\u00f3mo detectar software de acceso remoto en un sistema es fundamental para los profesionales de TI y los <a href=\"https:\/\/www.ninjaone.com\/es\/que-es-un-msp\/\">proveedores de servicios gestionados (MSP)<\/a>, ya que constituyen la primera l\u00ednea de defensa contra posibles violaciones de la seguridad y accesos no autorizados a los datos.<\/p>\n<h2>El script para detectar software de acceso remoto<\/h2>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"powershell\">#Requires -Version 5.1\r\n\r\n&lt;#\r\n.SYNOPSIS\r\n    This script will look for remote access tools installed on the system. It can be given a list of tools to ignore as well as grab the exclusion list from a designated custom field.\r\n    \r\n    DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n.DESCRIPTION\r\n    This script will look for remote access tools installed on the system. Below is the full list of tools. Please note you can give it a list of tools to ignore and you can have\r\n    it grab the list from a custom field of your choosing.\r\n\r\n    DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n\r\n    Remote Tools: AeroAdmin, Ammyy Admin, AnyDesk, BeyondTrust, Chrome Remote Desktop, Connectwise Control, DWService, GoToMyPC, LiteManager, LogMeIn, ManageEngine,\r\n    NoMachine, Parsec, Remote Utilities, RemotePC, Splashtop, Supremo, TeamViewer, TightVNC, UltraVNC, VNC Connect (RealVNC), Zoho Assist\r\n    RMM's: Atera, Automate, Datto RMM, Kaseya, N-Able N-Central, N-Able N-Sight, Syncro\r\n\r\n.EXAMPLE\r\n    (No Parameters)\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ExcludeTools \"Chrome Remote Desktop,Connectwise Control\"\r\n    A comma seperated list of tools you'd like to exclude from alerting on.\r\n.EXAMPLE\r\n    -ExcludeTools \"Chrome Remote Desktop,Connectwise Control\"\r\n    We couldn't find any active remote access tools!\r\n\r\nPARAMETER: -ExclusionsFromCustomField \"ReplaceMeWithAnyTextCustomField\"\r\n    The name of a custom field that contains a comma seperated list of tools to exclude from alerting. ex. \"ApprovedRemoteTools\"\r\n.EXAMPLE\r\n    -ExclusionsFromCustomField \"ReplaceMeWithAnyTextCustomField\"\r\n    We couldn't find any active remote access tools!\r\n\r\nPARAMETER: -ExportCSV \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    The name of a multiline custom field to export to in csv format. ex. \"RemoteTools\"\r\n.EXAMPLE\r\n    -ExportCSV \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ExportJSON \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    The name of a multiline custom field to export to in JSON format. ex. \"RemoteTools\"\r\n.EXAMPLE\r\n    -ExportJSON \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ShowNotFound\r\n    Show the tools the script did not find as well.\r\n.EXAMPLE\r\n    -ShowNotFound\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    AeroAdmin               No                  No\r\n    Ammyy Admin             No                  No\r\n    BeyondTrust             No                  No\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n    \r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    General notes: CustomFields must be multiline for export. Regular text is fine for ExclusionsFromCustomField\r\n    Release notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#&gt;\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$ExcludeTools,\r\n    [Parameter()]\r\n    [String]$ExclusionsFromCustomField,\r\n    [Parameter()]\r\n    [String]$ExportCSV,\r\n    [Parameter()]\r\n    [String]$ExportJSON,\r\n    [Parameter()]\r\n    [Switch]$ShowNotFound\r\n    &lt;#\r\n        ## ParameterName Requirement DefaultValue Type Options Description ##\r\n        ExcludeTools Optional none TEXT Comma seperated list of tools you would not like to look for.\r\n        ExclusionsFromCustomField Optional none TEXT Name of custom field you would like to grab exclusions from.\r\n        ExportCSV Optional none TEXT Name of multi-line custom field you would like to export results to. It will export them in csv format.\r\n        ExportJSON Optional none TEXT Name of multi-line custom field you would like to export results to. It will export them in json format.\r\n        ShowNotFound Optional false CHECKBOX Show results even if it didn't find that specific tool.\r\n    #&gt;\r\n)\r\n\r\nbegin {\r\n    #DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    #Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n\r\n    # Check's the two Uninstall registry keys to see if the app is installed. Needs the name as it would appear in Control Panel.\r\n    function Find-UninstallKey {\r\n        [CmdletBinding()]\r\n        param (\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$DisplayName,\r\n            [Parameter()]\r\n            [Switch]$UninstallString\r\n        )\r\n        process {\r\n            $UninstallList = New-Object System.Collections.Generic.List[Object]\r\n\r\n            $Result = Get-ChildItem HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall* | Get-ItemProperty | \r\n            Where-Object { $_.DisplayName -like \"*$DisplayName*\" }\r\n\r\n            if($Result){ $UninstallList.Add($Result) }\r\n\r\n            $Result = Get-ChildItem HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall* | Get-ItemProperty | \r\n            Where-Object { $_.DisplayName -like \"*$DisplayName*\" }\r\n\r\n            if($Result){ $UninstallList.Add($Result) }\r\n\r\n            # Programs don't always have an uninstall string listed here so to account for that I made this optional.\r\n            if ($UninstallString) {\r\n                # 64 Bit\r\n                $UninstallList | Select-Object -ExpandProperty UninstallString -ErrorAction Ignore\r\n            }\r\n            else {\r\n                $UninstallList\r\n            }\r\n        }\r\n    }\r\n\r\n    # This will see if the process is currently active. Some people may want to react sooner to these alerts if its currently running vs not.\r\n    function Find-Process {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Name\r\n        )\r\n        process {\r\n            Get-Process | Where-Object { $_.ProcessName -like \"*$Name*\" } | Select-Object -ExpandProperty Name\r\n        }\r\n    }\r\n\r\n    # This will search C:ProgramFiles and C:ProgramFiles(x86) for the executable these tools use to run.\r\n    function Find-Executable {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Path,\r\n            [Parameter()]\r\n            [Switch]$Special\r\n        )\r\n        process {\r\n            if(!$Special){\r\n                if (Test-Path \"$env:ProgramFiles$Path\") {\r\n                    \"$env:ProgramFiles$Path\"\r\n                }\r\n        \r\n                if (Test-Path \"${Env:ProgramFiles(x86)}$Path\") {\r\n                    \"${Env:ProgramFiles(x86)}$Path\"\r\n                }\r\n    \r\n                if (Test-Path \"$env:ProgramData$Path\") {\r\n                    \"$env:ProgramData$Path\"\r\n                }\r\n            }else{\r\n                if(Test-Path $Path){\r\n                    $Path\r\n                }\r\n            }\r\n        }\r\n    }\r\n\r\n    # Brought Get-CimInstance outside the function for better performance.\r\n\r\n    $ServiceList = Get-CimInstance win32_service\r\n    function Find-Service {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Name\r\n        )\r\n        process {\r\n            # Get-Service will display an error everytime it has an issue reading a service. Ignoring them as they're not relevant.\r\n            $ServiceList | Where-Object {$_.State -notlike \"Disabled\" -and $_.State -notlike \"Stopped\"} | \r\n            Where-Object {$_.PathName -Like \"*$Name.exe*\"}\r\n        }\r\n    }\r\n\r\n    function Export-CustomField {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter()]\r\n            [String]$Name,\r\n            [Parameter()]\r\n            [ValidateSet(\"csv\", \"json\")]\r\n            [String]$Format,\r\n            [Parameter()]\r\n            [PSCustomObject]$Object\r\n        )\r\n        if ($Format -eq \"csv\") {\r\n            $csv = $Object | ConvertTo-Csv -NoTypeInformation | Out-String\r\n            Ninja-Property-Set $Name $csv\r\n        }\r\n        else {\r\n            $json = $Object | ConvertTo-Json | Out-String\r\n            Ninja-Property-Set $Name $json\r\n        }\r\n    }\r\n\r\n    # This define's what tools we're looking for and how the script can find them. Some don't actually install anywhere (portable app) others do. \r\n    # Some change their installation path everytime so not particularly worth it to find it that way.\r\n    # Others store themselves in a super weird directory. Many don't list exactly where there .exe file is stored and suggest you exclude the whole folder from the av.\r\n    $RemoteToolList = @(\r\n        [PSCustomObject]@{Name = \"AeroAdmin\"; ProcessName = \"AeroAdmin\" }\r\n        [PSCustomObject]@{Name = \"Ammyy Admin\"; ProcessName = \"AA_v3\" }\r\n        [PSCustomObject]@{Name = \"AnyDesk\"; DisplayName = \"AnyDesk\"; ProcessName = \"AnyDesk\"; ExecutablePath = \"AnyDeskAnyDesk.exe\" }\r\n        [PSCustomObject]@{Name = \"BeyondTrust\"; DisplayName = \"Remote Support Jump Client\", \"Jumpoint\"; ProcessName = \"bomgar-jpt\" }\r\n        [PSCustomObject]@{Name = \"Chrome Remote Desktop\"; DisplayName = \"Chrome Remote Desktop Host\"; ProcessName = \"remoting_host\"; ExecutablePath = \"GoogleChrome Remote Desktop112.0.5615.26remoting_host.exe\" }\r\n        [PSCustomObject]@{Name = \"Connectwise Control\"; DisplayName = \"ScreenConnect Client\"; ProcessName = \"ScreenConnect.ClientService\" }\r\n        [PSCustomObject]@{Name = \"DWService\"; DisplayName = \"DWAgent\"; ProcessName = \"dwagent\",\"dwagsvc\"; ExecutablePath = \"DWAgentruntimedwagent.exe\" }\r\n        [PSCustomObject]@{Name = \"GoToMyPC\"; DisplayName = \"GoToMyPC\"; ProcessName = \"g2comm\", \"g2pre\", \"g2svc\", \"g2tray\"; ExecutablePath = \"GoToMyPCg2comm.exe\", \"GoToMyPCg2pre.exe\", \"GoToMyPCg2svc.exe\", \"GoToMyPCg2tray.exe\" }\r\n        [PSCustomObject]@{Name = \"LiteManager\"; DisplayName = \"LiteManager Pro - Server\"; ProcessName = \"ROMServer\", \"ROMFUSClient\"; ExecutablePath = \"LiteManager Pro - ServerROMFUSClient.exe\", \"LiteManager Pro - ServerROMServer.exe\" }\r\n        [PSCustomObject]@{Name = \"LogMeIn\"; DisplayName = \"LogMeIn\"; ProcessName = \"LogMeIn\"; ExecutablePath = \"LogMeInx64LogMeIn.exe\", \"LogMeInx64LogMeInSystray.exe\" }\r\n        [PSCustomObject]@{Name = \"ManageEngine\"; DisplayName = \"ManageEngine Remote Access Plus - Server\", \"ManageEngine UEMS - Agent\"; ProcessName = \"dcagenttrayicon\", \"UEMS\", \"dcagentservice\"; ExecutablePath = \"UEMS_Agentbindcagenttrayicon.exe\", \"UEMS_CentralServerbinUEMS.exe\", \"UEMS_Agentbindcagentservice.exe\" }\r\n        [PSCustomObject]@{Name = \"NoMachine\"; DisplayName = \"NoMachine\"; ProcessName = \"nxd\", \"nxnode.bin\", \"nxserver.bin\", \"nxservice64\"; ExecutablePath = \"NoMachinebinnxd.exe\", \"NoMachinebinnxnode.bin\", \"NoMachinebinnxserver.bin\", \"NoMachinebinnxservice64.exe\" }\r\n        [PSCustomObject]@{Name = \"Parsec\"; DisplayName = \"Parsec\"; ProcessName = \"parsecd\", \"pservice\"; ExecutablePath = \"Parsecparsecd.exe\", \"Parsecpservice.exe\" }\r\n        [PSCustomObject]@{Name = \"Remote Utilities\"; DisplayName = \"Remote Utilities - Host\"; ProcessName = \"rutserv\", \"rfusclient\"; ExecutablePath = \"Remote Utilities - Hostrfusclient.exe\" }\r\n        [PSCustomObject]@{Name = \"RemotePC\"; DisplayName = \"RemotePC\"; ProcessName = \"RemotePCHostUI\",\"RPCPerformanceService\"; ExecutablePath = \"RemotePC HostRemotePCHostUI.exe\", \"RemotePC HostRemotePCPerformanceRPCPerformanceService.exe\" }\r\n        [PSCustomObject]@{Name = \"Splashtop\"; DisplayName = \"Splashtop Streamer\"; ProcessName = \"SRAgent\", \"SRAppPB\", \"SRFeature\", \"SRManager\", \"SRService\"; ExecutablePath = \"SplashtopSplashtop RemoteServerSRService.exe\" }\r\n        [PSCustomObject]@{Name = \"Supremo\"; ProcessName = \"Supremo\", \"SupremoHelper\", \"SupremoService\"; ExecutablePath = \"SupremoSupremoService.exe\" }\r\n        [PSCustomObject]@{Name = \"TeamViewer\"; DisplayName = \"TeamViewer\"; ProcessName = \"TeamViewer\", \"TeamViewer_Service\", \"tv_w32\", \"tv_x64\"; ExecutablePath = \"TeamViewerTeamViewer.exe\", \"TeamViewerTeamViewer_Service.exe\", \"TeamViewertv_w32.exe\", \"TeamViewertv_x64.exe\" }\r\n        [PSCustomObject]@{Name = \"TightVNC\"; DisplayName = \"TightVNC\"; ProcessName = \"tvnserver\"; ExecutablePath = \"TightVNCtvnserver.exe\" }\r\n        [PSCustomObject]@{Name = \"UltraVNC\"; DisplayName = \"UltraVNC\"; ProcessName = \"winvnc\"; ExecutablePath = \"uvnc bvbaUltraVNCWinVNC.exe\" }\r\n        [PSCustomObject]@{Name = \"VNC Connect (RealVNC)\"; DisplayName = \"VNC Server\"; ProcessName = \"vncserver\"; ExecutablePath = \"RealVNCVNC Servervncserver.exe\" }\r\n        [PSCustomObject]@{Name = \"Zoho Assist\"; DisplayName = \"Zoho Assist Unattended Agent\"; ProcessName = \"ZohoURS\", \"ZohoURSService\"; ExecutablePath = \"ZohoMeetingUnAttendedZohoMeetingZohoURS.exe\", \"ZohoMeetingUnAttendedZohoMeetingZohoURSService.exe\" }\r\n        [PSCustomObject]@{Name = \"Atera\"; DisplayName = \"AteraAgent\"; ProcessName = \"AteraAgent\"; ExecutablePath = \"ATERA NetworksAteraAgentAteraAgent.exe\"}\r\n        [PSCustomObject]@{Name = \"Automate\"; DisplayName = \"Connectwise Automate\"; ProcessName = \"LTService\", \"LabTechService\"; SpecialExecutablePath = \"C:WindowsLTSvcLTSvc.exe\"}\r\n        [PSCustomObject]@{Name = \"Datto RMM\"; DisplayName = \"Datto RMM\"; ProcessName = \"AEMAgent\"; ExecutablePath = \"CentraStageAEMAgentAEMAgent.exe\", \"CentraStagegui.exe\"}\r\n        [PSCustomObject]@{Name = \"Kaseya\"; DisplayName = \"Kaseya Agent\"; ProcessName = \"AgentMon\", \"KaseyaRemoteControlHost\", \"Kasaya.AgentEndpoint\"; ExecutablePath = \"KaseyaAgentMonAgentMon.exe\"}\r\n        [PSCustomObject]@{Name = \"N-Able N-Central\"; DisplayName = \"Windows Agent\"; ProcessName = \"winagent\"; ExecutablePath = \"N-able TechnologiesWindows Agentwinagent.exe\"}\r\n        [PSCustomObject]@{Name = \"N-Able N-Sight\"; DisplayName = \"Advanced Monitoring Agent\"; ProcessName = \"winagent\"; ExecutablePath = \"Advanced Monitoring Agentwinagent.exe\", \"Advanced Monitoring Agent GPwinagent.exe\"}\r\n        [PSCustomObject]@{Name = \"Syncro\"; DisplayName = \"Syncro\",\"Kabuto\"; ProcessName = \"Syncro.App.Runner\", \"Kabuto.App.Runner\", \"Syncro.Service.Runner\", \"Kabuto.Service.Runner\", \"SyncroLive.Agent.Runner\", \"Kabuto.Agent.Runner\", \"SyncroLive.Agent.Service\", \"Syncro.Access.Service\", \"Syncro.Access.App\"; ExecutablePath = \"RepairTechSyncroSyncro.Service.Runner.exe\", \"RepairTechSyncroSyncro.App.Runner.exe\"}\r\n    )\r\n}\r\nprocess {\r\n\r\n    # Lets see what tools we don't want to alert on.\r\n    $ExcludedTools = New-Object System.Collections.Generic.List[String]\r\n\r\n    if ($ExcludeTools) {\r\n        $ExcludedTools.Add(($ExcludeTools.split(',')).Trim())\r\n    }\r\n\r\n    # Grabs the info we need from a textbox.\r\n    if ($env:ExcludeTools) {\r\n        $ExcludedTools.Add($env:ExcludeTools.split(','))\r\n    }\r\n\r\n    # For this kind of alert it might be worth it to create a whole custom field of ignorables.\r\n    if ($ExclusionsFromCustomField) {\r\n        $ExcludedTools.Add((Ninja-Property-Get $ExclusionsFromCustomField -split(',')).trim())\r\n    }\r\n\r\n    if ($env:ExclusionsFromCustomField) {\r\n        $ExcludedTools.Add((Ninja-Property-Get $env:ExclusionsFromCustomField -split(',')).trim())\r\n    }\r\n\r\n    if ($ExportCSV -or $Env:ExportCSV) {\r\n        $Format = \"csv\"\r\n\r\n        if ($ExportCSV) {\r\n            $ExportResults = $ExportCSV\r\n        }\r\n\r\n        if ($env:ExportCSV) {\r\n            $ExportResults = $env:ExportCSV\r\n        }\r\n    }elseif ($ExportJSON -or $env:ExportJSON) {\r\n        $Format = \"json\"\r\n\r\n        if ($ExportJSON) {\r\n            $ExportResults = $ExportJSON\r\n        }\r\n\r\n        if ($env:ExportJSON) {\r\n            $ExportResults = $env:ExportJSON\r\n        }\r\n    }\r\n\r\n    # This take's our list and begins searching by the 4 method's in the begin block. \r\n    $RemoteAccessTools = $RemoteToolList | ForEach-Object {\r\n\r\n        $UninstallKey = if ($_.DisplayName) {\r\n            $_.DisplayName | Find-UninstallKey\r\n        }\r\n        \r\n        $UninstallInfo = if ($_.DisplayName) {\r\n            $_.DisplayName | Find-UninstallKey -UninstallString\r\n        }\r\n        \r\n        $RunningStatus = if ($_.ProcessName) {\r\n            $_.ProcessName | Find-Process\r\n        }\r\n\r\n        $ServiceStatus = if($_.ProcessName) {\r\n            $_.ProcessName | Find-Service\r\n        }\r\n        \r\n        $InstallPath = if ($_.ExecutablePath) {\r\n            $_.ExecutablePath | Find-Executable\r\n        }elseif($_.SpecialExecutablePath){\r\n            $_.SpecialExecutablePath | Find-Executable -Special\r\n        }\r\n\r\n        if ($UninstallKey -or $RunningStatus -or $InstallPath -or $ServiceStatus) {\r\n            $Installed = \"Yes\"\r\n        }\r\n        else {\r\n            $Installed = \"No\"\r\n        }\r\n\r\n        [PSCustomObject]@{\r\n            Name              = $_.Name\r\n            Installed         = $Installed\r\n            CurrentlyRunning  = if ($RunningStatus) { \"Yes\" }else { \"No\" }\r\n            HasRunningService = if ($ServiceStatus) { \"Yes\" }else { \"No\" }\r\n            UninstallString   = $UninstallInfo\r\n            ExePath           = $InstallPath\r\n        } | Where-Object { $ExcludedTools -notcontains $_.Name }\r\n    }\r\n\r\n    $ActiveRemoteAccessTools = $RemoteAccessTools | Where-Object {$_.Installed -eq \"Yes\"}\r\n\r\n    # If we found anything in the three check's we're gonna indicate it's installed but we may also want to save our results to a custom field.\r\n    # We also may want to output more than \"We couldn't find any active remote access tools!\" in the event we find nothing.\r\n    if ($ShowNotFound -or $env:ShowNotFound) {\r\n\r\n        $RemoteAccessTools | Format-Table -Property Name, Installed, CurrentlyRunning, HasRunningService, UninstallString -AutoSize -Wrap | Out-String | Write-Host\r\n\r\n        if($ExportResults){\r\n            Export-CustomField -Name $ExportResults -Format $Format -Object ($RemoteAccessTools | Select-Object Name, Installed, CurrentlyRunning, HasRunningService)\r\n        }\r\n\r\n    }else{\r\n        if($ActiveRemoteAccessTools){\r\n\r\n            $ActiveRemoteAccessTools | Format-Table -Property Name, CurrentlyRunning, HasRunningService, UninstallString -AutoSize -Wrap | Out-String | Write-Host\r\n\r\n            if($ExportResults){\r\n                Export-CustomField -Name $ExportResults -Format $Format -Object ($ActiveRemoteAccessTools | Select-Object Name, CurrentlyRunning, HasRunningService)\r\n            }\r\n\r\n        }else{\r\n            Write-Host \"We couldn't find any active remote access tools!\"\r\n        }\r\n    }\r\n\r\n    if($ActiveRemoteAccessTools){\r\n        # We're going to set a failure status code in the event that we find something.\r\n        exit 1\r\n    }\r\n    else {\r\n        exit 0\r\n    }\r\n}<\/pre>\n<p>&nbsp;<\/p>\n\n<div class=\"in-context-cta\"><p style=\"text-align: center;\">Accede a m\u00e1s de 300 scripts en el Dojo de NinjaOne<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.ninjaone.com\/freetrialform\/\">Obt\u00e9n acceso<\/a><\/p>\n<\/div>\n<h2>An\u00e1lisis detallado<\/h2>\n<p>Detectar software de acceso remoto implica algunos pasos indispensables:<\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><strong>Supervisi\u00f3n del tr\u00e1fico de red<\/strong>: el script para detectar software de acceso remoto comienza por supervisar el tr\u00e1fico de la red. Patrones inusuales o direcciones IP desconocidas pueden ser indicadores.<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><strong>Procesos y tareas del sistema<\/strong>: controlar regularmente los procesos activos del sistema puede ayudar a detectar software de acceso remoto no autorizado. Cualquier proceso desconocido justifica una investigaci\u00f3n m\u00e1s profunda.<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><strong>Verificaci\u00f3n de software<\/strong>: utilizando herramientas integradas en el sistema como el \u00abAdministrador de tareas\u00bb de Windows o el \u00abMonitor de actividad\u00bb de macOS, se puede obtener una lista de todas las aplicaciones instaladas. Buscar software desconocido a veces puede ayudar a detectar software de acceso remoto dentro del sistema.<\/li>\n<\/ul>\n<h2>Posibles casos de uso<\/h2>\n<p>Imagina a Alex, un profesional de TI de una empresa mediana. Se da cuenta de que el ancho de banda de la red aumenta durante las horas no laborables. Tras investigar m\u00e1s a fondo, identifica una direcci\u00f3n IP desconocida que accede constantemente a su red. Utilizando herramientas de control del sistema, descubre un software de acceso remoto instalado en varios sistemas de oficina que nadie recuerda haber instalado. Al identificar y eliminar este software, Alex logra impedir una posible filtraci\u00f3n de datos.<\/p>\n<h2>Comparaciones<\/h2>\n<p>Los m\u00e9todos tradicionales para detectar software de acceso remoto incluyen auditor\u00edas manuales, comprobaci\u00f3n de registros de firewalls o el uso de software antivirus. Aunque estos m\u00e9todos pueden ser eficaces, no son infalibles. El enfoque del script para detectar software de acceso remoto automatiza el proceso de detecci\u00f3n, haci\u00e9ndolo a la vez exhaustivo y eficaz en el tiempo. Este m\u00e9todo proactivo a menudo puede detectar RAT m\u00e1s nuevos y sofisticados que podr\u00edan eludir los m\u00e9todos convencionales.<\/p>\n<h2>Preguntas frecuentes<\/h2>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><strong>\u00bfCon qu\u00e9 frecuencia debo controlar las herramientas de acceso remoto?<\/strong><br \/>\nRegularmente, sobre todo si te encuentras en un entorno que instala y prueba con frecuencia nuevo software.<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><strong>\u00bfEste m\u00e9todo de detecci\u00f3n puede identificar todo el software de acceso remoto?<\/strong><br \/>\nAunque es completo, ning\u00fan m\u00e9todo es infalible. Es fundamental combinar m\u00faltiples enfoques para garantizar una seguridad s\u00f3lida.<\/li>\n<\/ul>\n<div class=\"in-context-cta\"><h2>La opini\u00f3n de Gavin<\/h2>\n<p style=\"text-align: left;\">Tener la capacidad de detectar cuando se instala software remoto no aprobado en una m\u00e1quina es fundamental para mantener seguros los dispositivos, tu red m\u00e1s amplia y los datos de tu organizaci\u00f3n.<\/p>\n<p style=\"text-align: left;\">El <a href=\"https:\/\/www.ninjaone.com\/blog\/what-is-shadow-it\/\">shadow IT<\/a> se refiere a los sistemas, dispositivos, software o aplicaciones que se utilizan y gestionan fuera del \u00e1mbito oficial del departamento de TI de tu organizaci\u00f3n. Esto suele ocurrir cuando los empleados utilizan sus propias soluciones o tecnolog\u00edas sin aprobaci\u00f3n o supervisi\u00f3n expl\u00edcitas. En este caso, cualquier software remoto que se instale sin conocimiento de la organizaci\u00f3n es un ejemplo de shadow IT. Cuando esto ocurre, se plantean varios retos cr\u00edticos:<\/p>\n<ul>\n<li><strong>Falta de supervisi\u00f3n del departamento de TI: <\/strong> cuando se instala software remoto en los dispositivos sin avisar, a menudo se eluden los protocolos est\u00e1ndar de seguridad, control de datos y cumplimiento de la normativa que puedan existir en la organizaci\u00f3n.<\/li>\n<li><strong>Riesgos de seguridad: <\/strong> dado que el software remoto no ha sido sometido a las mismas medidas de seguridad que los recursos inform\u00e1ticos autorizados, puede introducir vulnerabilidades (el departamento de TI no puede parchear software que desconoce) que potencialmente pueden causar violaciones de datos o incidentes de seguridad.<\/li>\n<li><strong>Riesgo del proveedor: <\/strong> algunos proveedores tienen mejores capas de seguridad que otros. La introducci\u00f3n de software, especialmente software remoto cuyos proveedores no han sido debidamente investigados, puede introducir riesgos adicionales para la organizaci\u00f3n e incluso ponerla en riesgo de no superar las evaluaciones de cumplimiento o seguridad.<\/li>\n<\/ul>\n<p style=\"text-align: left;\">Este script puede resultar \u00fatil, ya que es capaz de detectar de una lista conocida de <a href=\"https:\/\/www.ninjaone.com\/es\/acceso-remoto\/\">software de acceso remoto<\/a>, y activarse cuando detecta algo que no est\u00e1 en la lista autorizada. M\u00e1s all\u00e1 de los problemas de seguridad, este tipo de detecci\u00f3n tiene otras ventajas:<\/p>\n<div class=\"elementToProof\">\n<ul>\n<li>Para los MSP, esto puede ser un buen indicio de que tu cliente est\u00e1 colaborando con otro MSP o empresa de TI<\/li>\n<li>Puede ayudar a identificar restos de antiguos programas de acceso remoto instalados en la red<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Reflexiones finales<\/h2>\n<p>Un <a href=\"https:\/\/www.ninjaone.com\/es\/acceso-remoto\/\">software de acceso remoto<\/a> no detectado puede dar lugar a infracciones importantes, robo de datos o incluso <a href=\"https:\/\/www.ninjaone.com\/es\/blog\/como-detectar-el-ransomware\/\">ataques de ransomware<\/a>. A medida que m\u00e1s empresas migran a Internet, garantizar la seguridad de cada endpoint se convierte en una tarea fundamental. No tom\u00e1rselo en serio podr\u00eda tener repercusiones financieras, operativas y de reputaci\u00f3n.<\/p>\n","protected":false},"author":35,"featured_media":143989,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[4265],"class_list":["post-240926","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows","use_cases-configuracion-del-sistema"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/script_hub\/240926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/comments?post=240926"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/media\/143989"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/media?parent=240926"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/operating_system?post=240926"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/es\/wp-json\/wp\/v2\/use_cases?post=240926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}