{"id":809720,"date":"2026-05-19T09:08:21","date_gmt":"2026-05-19T09:08:21","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&#038;p=809720"},"modified":"2026-05-19T09:08:21","modified_gmt":"2026-05-19T09:08:21","slug":"detectar-software-de-acesso-remoto-usando-o-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/pt-br\/script-hub\/detectar-software-de-acesso-remoto-usando-o-powershell\/","title":{"rendered":"Como detectar software de acesso remoto em um sistema usando o PowerShell"},"content":{"rendered":"<p>Com o aumento do trabalho remoto e a ado\u00e7\u00e3o generalizada de tecnologias de nuvem, garantir <a href=\"https:\/\/www.ninjaone.com\/pt-br\/blog\/o-que-e-seguranca-de-ponto-de-extremidade-e-como-ela-funciona\/\">a seguran\u00e7a dos endpoints<\/a> tornou-se fundamental para os profissionais de TI em todo o mundo. <strong>A detec\u00e7\u00e3o de software de acesso remoto<\/strong> tem sido uma preocupa\u00e7\u00e3o crescente, pois muitas vezes ele pode ser o ponto de entrada para entidades mal-intencionadas.<\/p>\n<h2>Hist\u00f3rico<\/h2>\n<p><a href=\"https:\/\/www.ninjaone.com\/blog\/what-is-a-remote-access-tool-rat\/\">As ferramentas de acesso remoto (RATs)<\/a> j\u00e1 existem h\u00e1 algum tempo. Embora possam ser extremamente ben\u00e9ficos para a solu\u00e7\u00e3o remota de problemas e tarefas administrativas, eles tamb\u00e9m podem ser explorados por advers\u00e1rios cibern\u00e9ticos para obter acesso n\u00e3o autorizado aos sistemas. Entender como detectar essas ferramentas em um sistema \u00e9 fundamental para os profissionais de TI e para os <a href=\"https:\/\/www.ninjaone.com\/what-is-an-msp\/\">provedores de servi\u00e7os gerenciados (MSPs)<\/a>. Eles servem como a primeira linha de defesa contra poss\u00edveis viola\u00e7\u00f5es de seguran\u00e7a e acesso n\u00e3o autorizado a dados.<\/p>\n<h2>O roteiro:<\/h2>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"powershell\">#Requires -Version 5.1\r\n\r\n&lt;#\r\n.SYNOPSIS\r\n    This script will look for remote access tools installed on the system. It can be given a list of tools to ignore as well as grab the exclusion list from a designated custom field.\r\n    \r\n    DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n.DESCRIPTION\r\n    This script will look for remote access tools installed on the system. Below is the full list of tools. Please note you can give it a list of tools to ignore and you can have\r\n    it grab the list from a custom field of your choosing.\r\n\r\n    DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n\r\n    Remote Tools: AeroAdmin, Ammyy Admin, AnyDesk, BeyondTrust, Chrome Remote Desktop, Connectwise Control, DWService, GoToMyPC, LiteManager, LogMeIn, ManageEngine,\r\n    NoMachine, Parsec, Remote Utilities, RemotePC, Splashtop, Supremo, TeamViewer, TightVNC, UltraVNC, VNC Connect (RealVNC), Zoho Assist\r\n    RMM's: Atera, Automate, Datto RMM, Kaseya, N-Able N-Central, N-Able N-Sight, Syncro\r\n\r\n.EXAMPLE\r\n    (No Parameters)\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ExcludeTools \"Chrome Remote Desktop,Connectwise Control\"\r\n    A comma seperated list of tools you'd like to exclude from alerting on.\r\n.EXAMPLE\r\n    -ExcludeTools \"Chrome Remote Desktop,Connectwise Control\"\r\n    We couldn't find any active remote access tools!\r\n\r\nPARAMETER: -ExclusionsFromCustomField \"ReplaceMeWithAnyTextCustomField\"\r\n    The name of a custom field that contains a comma seperated list of tools to exclude from alerting. ex. \"ApprovedRemoteTools\"\r\n.EXAMPLE\r\n    -ExclusionsFromCustomField \"ReplaceMeWithAnyTextCustomField\"\r\n    We couldn't find any active remote access tools!\r\n\r\nPARAMETER: -ExportCSV \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    The name of a multiline custom field to export to in csv format. ex. \"RemoteTools\"\r\n.EXAMPLE\r\n    -ExportCSV \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ExportJSON \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    The name of a multiline custom field to export to in JSON format. ex. \"RemoteTools\"\r\n.EXAMPLE\r\n    -ExportJSON \"ReplaceMeWithAnyMultiLineCustomField\"\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n\r\nPARAMETER: -ShowNotFound\r\n    Show the tools the script did not find as well.\r\n.EXAMPLE\r\n    -ShowNotFound\r\n    Name                    CurrentlyRunning    HasRunningService   UninstallString\r\n    ----                    ----------------    -----------------   ---------------\r\n    AeroAdmin               No                  No\r\n    Ammyy Admin             No                  No\r\n    BeyondTrust             No                  No\r\n    Connectwise Control     Yes                 Yes                 MsiExec \/X{examplestring}\r\n    Chrome Remote Desktop   Yes                 Yes                 MsiExec \/X{examplestring}\r\n    \r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    General notes: CustomFields must be multiline for export. Regular text is fine for ExclusionsFromCustomField\r\n    Release notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#&gt;\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$ExcludeTools,\r\n    [Parameter()]\r\n    [String]$ExclusionsFromCustomField,\r\n    [Parameter()]\r\n    [String]$ExportCSV,\r\n    [Parameter()]\r\n    [String]$ExportJSON,\r\n    [Parameter()]\r\n    [Switch]$ShowNotFound\r\n    &lt;#\r\n        ## ParameterName Requirement DefaultValue Type Options Description ##\r\n        ExcludeTools Optional none TEXT Comma seperated list of tools you would not like to look for.\r\n        ExclusionsFromCustomField Optional none TEXT Name of custom field you would like to grab exclusions from.\r\n        ExportCSV Optional none TEXT Name of multi-line custom field you would like to export results to. It will export them in csv format.\r\n        ExportJSON Optional none TEXT Name of multi-line custom field you would like to export results to. It will export them in json format.\r\n        ShowNotFound Optional false CHECKBOX Show results even if it didn't find that specific tool.\r\n    #&gt;\r\n)\r\n\r\nbegin {\r\n    #DISCLAIMER: This script is provided as a best effort for detecting remote access software installed on an agent, but it is not guaranteed to be 100% accurate. \r\n    #Some remote access software may not be detected, or false positives may be reported. Use this script at your own risk and verify its results with other methods where possible.\r\n\r\n    # Check's the two Uninstall registry keys to see if the app is installed. Needs the name as it would appear in Control Panel.\r\n    function Find-UninstallKey {\r\n        [CmdletBinding()]\r\n        param (\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$DisplayName,\r\n            [Parameter()]\r\n            [Switch]$UninstallString\r\n        )\r\n        process {\r\n            $UninstallList = New-Object System.Collections.Generic.List[Object]\r\n\r\n            $Result = Get-ChildItem HKLM:SoftwareWow6432NodeMicrosoftWindowsCurrentVersionUninstall* | Get-ItemProperty | \r\n            Where-Object { $_.DisplayName -like \"*$DisplayName*\" }\r\n\r\n            if($Result){ $UninstallList.Add($Result) }\r\n\r\n            $Result = Get-ChildItem HKLM:SoftwareMicrosoftWindowsCurrentVersionUninstall* | Get-ItemProperty | \r\n            Where-Object { $_.DisplayName -like \"*$DisplayName*\" }\r\n\r\n            if($Result){ $UninstallList.Add($Result) }\r\n\r\n            # Programs don't always have an uninstall string listed here so to account for that I made this optional.\r\n            if ($UninstallString) {\r\n                # 64 Bit\r\n                $UninstallList | Select-Object -ExpandProperty UninstallString -ErrorAction Ignore\r\n            }\r\n            else {\r\n                $UninstallList\r\n            }\r\n        }\r\n    }\r\n\r\n    # This will see if the process is currently active. Some people may want to react sooner to these alerts if its currently running vs not.\r\n    function Find-Process {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Name\r\n        )\r\n        process {\r\n            Get-Process | Where-Object { $_.ProcessName -like \"*$Name*\" } | Select-Object -ExpandProperty Name\r\n        }\r\n    }\r\n\r\n    # This will search C:ProgramFiles and C:ProgramFiles(x86) for the executable these tools use to run.\r\n    function Find-Executable {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Path,\r\n            [Parameter()]\r\n            [Switch]$Special\r\n        )\r\n        process {\r\n            if(!$Special){\r\n                if (Test-Path \"$env:ProgramFiles$Path\") {\r\n                    \"$env:ProgramFiles$Path\"\r\n                }\r\n        \r\n                if (Test-Path \"${Env:ProgramFiles(x86)}$Path\") {\r\n                    \"${Env:ProgramFiles(x86)}$Path\"\r\n                }\r\n    \r\n                if (Test-Path \"$env:ProgramData$Path\") {\r\n                    \"$env:ProgramData$Path\"\r\n                }\r\n            }else{\r\n                if(Test-Path $Path){\r\n                    $Path\r\n                }\r\n            }\r\n        }\r\n    }\r\n\r\n    # Brought Get-CimInstance outside the function for better performance.\r\n\r\n    $ServiceList = Get-CimInstance win32_service\r\n    function Find-Service {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter(ValueFromPipeline)]\r\n            [String]$Name\r\n        )\r\n        process {\r\n            # Get-Service will display an error everytime it has an issue reading a service. Ignoring them as they're not relevant.\r\n            $ServiceList | Where-Object {$_.State -notlike \"Disabled\" -and $_.State -notlike \"Stopped\"} | \r\n            Where-Object {$_.PathName -Like \"*$Name.exe*\"}\r\n        }\r\n    }\r\n\r\n    function Export-CustomField {\r\n        [CmdletBinding()]\r\n        param(\r\n            [Parameter()]\r\n            [String]$Name,\r\n            [Parameter()]\r\n            [ValidateSet(\"csv\", \"json\")]\r\n            [String]$Format,\r\n            [Parameter()]\r\n            [PSCustomObject]$Object\r\n        )\r\n        if ($Format -eq \"csv\") {\r\n            $csv = $Object | ConvertTo-Csv -NoTypeInformation | Out-String\r\n            Ninja-Property-Set $Name $csv\r\n        }\r\n        else {\r\n            $json = $Object | ConvertTo-Json | Out-String\r\n            Ninja-Property-Set $Name $json\r\n        }\r\n    }\r\n\r\n    # This define's what tools we're looking for and how the script can find them. Some don't actually install anywhere (portable app) others do. \r\n    # Some change their installation path everytime so not particularly worth it to find it that way.\r\n    # Others store themselves in a super weird directory. Many don't list exactly where there .exe file is stored and suggest you exclude the whole folder from the av.\r\n    $RemoteToolList = @(\r\n        [PSCustomObject]@{Name = \"AeroAdmin\"; ProcessName = \"AeroAdmin\" }\r\n        [PSCustomObject]@{Name = \"Ammyy Admin\"; ProcessName = \"AA_v3\" }\r\n        [PSCustomObject]@{Name = \"AnyDesk\"; DisplayName = \"AnyDesk\"; ProcessName = \"AnyDesk\"; ExecutablePath = \"AnyDeskAnyDesk.exe\" }\r\n        [PSCustomObject]@{Name = \"BeyondTrust\"; DisplayName = \"Remote Support Jump Client\", \"Jumpoint\"; ProcessName = \"bomgar-jpt\" }\r\n        [PSCustomObject]@{Name = \"Chrome Remote Desktop\"; DisplayName = \"Chrome Remote Desktop Host\"; ProcessName = \"remoting_host\"; ExecutablePath = \"GoogleChrome Remote Desktop112.0.5615.26remoting_host.exe\" }\r\n        [PSCustomObject]@{Name = \"Connectwise Control\"; DisplayName = \"ScreenConnect Client\"; ProcessName = \"ScreenConnect.ClientService\" }\r\n        [PSCustomObject]@{Name = \"DWService\"; DisplayName = \"DWAgent\"; ProcessName = \"dwagent\",\"dwagsvc\"; ExecutablePath = \"DWAgentruntimedwagent.exe\" }\r\n        [PSCustomObject]@{Name = \"GoToMyPC\"; DisplayName = \"GoToMyPC\"; ProcessName = \"g2comm\", \"g2pre\", \"g2svc\", \"g2tray\"; ExecutablePath = \"GoToMyPCg2comm.exe\", \"GoToMyPCg2pre.exe\", \"GoToMyPCg2svc.exe\", \"GoToMyPCg2tray.exe\" }\r\n        [PSCustomObject]@{Name = \"LiteManager\"; DisplayName = \"LiteManager Pro - Server\"; ProcessName = \"ROMServer\", \"ROMFUSClient\"; ExecutablePath = \"LiteManager Pro - ServerROMFUSClient.exe\", \"LiteManager Pro - ServerROMServer.exe\" }\r\n        [PSCustomObject]@{Name = \"LogMeIn\"; DisplayName = \"LogMeIn\"; ProcessName = \"LogMeIn\"; ExecutablePath = \"LogMeInx64LogMeIn.exe\", \"LogMeInx64LogMeInSystray.exe\" }\r\n        [PSCustomObject]@{Name = \"ManageEngine\"; DisplayName = \"ManageEngine Remote Access Plus - Server\", \"ManageEngine UEMS - Agent\"; ProcessName = \"dcagenttrayicon\", \"UEMS\", \"dcagentservice\"; ExecutablePath = \"UEMS_Agentbindcagenttrayicon.exe\", \"UEMS_CentralServerbinUEMS.exe\", \"UEMS_Agentbindcagentservice.exe\" }\r\n        [PSCustomObject]@{Name = \"NoMachine\"; DisplayName = \"NoMachine\"; ProcessName = \"nxd\", \"nxnode.bin\", \"nxserver.bin\", \"nxservice64\"; ExecutablePath = \"NoMachinebinnxd.exe\", \"NoMachinebinnxnode.bin\", \"NoMachinebinnxserver.bin\", \"NoMachinebinnxservice64.exe\" }\r\n        [PSCustomObject]@{Name = \"Parsec\"; DisplayName = \"Parsec\"; ProcessName = \"parsecd\", \"pservice\"; ExecutablePath = \"Parsecparsecd.exe\", \"Parsecpservice.exe\" }\r\n        [PSCustomObject]@{Name = \"Remote Utilities\"; DisplayName = \"Remote Utilities - Host\"; ProcessName = \"rutserv\", \"rfusclient\"; ExecutablePath = \"Remote Utilities - Hostrfusclient.exe\" }\r\n        [PSCustomObject]@{Name = \"RemotePC\"; DisplayName = \"RemotePC\"; ProcessName = \"RemotePCHostUI\",\"RPCPerformanceService\"; ExecutablePath = \"RemotePC HostRemotePCHostUI.exe\", \"RemotePC HostRemotePCPerformanceRPCPerformanceService.exe\" }\r\n        [PSCustomObject]@{Name = \"Splashtop\"; DisplayName = \"Splashtop Streamer\"; ProcessName = \"SRAgent\", \"SRAppPB\", \"SRFeature\", \"SRManager\", \"SRService\"; ExecutablePath = \"SplashtopSplashtop RemoteServerSRService.exe\" }\r\n        [PSCustomObject]@{Name = \"Supremo\"; ProcessName = \"Supremo\", \"SupremoHelper\", \"SupremoService\"; ExecutablePath = \"SupremoSupremoService.exe\" }\r\n        [PSCustomObject]@{Name = \"TeamViewer\"; DisplayName = \"TeamViewer\"; ProcessName = \"TeamViewer\", \"TeamViewer_Service\", \"tv_w32\", \"tv_x64\"; ExecutablePath = \"TeamViewerTeamViewer.exe\", \"TeamViewerTeamViewer_Service.exe\", \"TeamViewertv_w32.exe\", \"TeamViewertv_x64.exe\" }\r\n        [PSCustomObject]@{Name = \"TightVNC\"; DisplayName = \"TightVNC\"; ProcessName = \"tvnserver\"; ExecutablePath = \"TightVNCtvnserver.exe\" }\r\n        [PSCustomObject]@{Name = \"UltraVNC\"; DisplayName = \"UltraVNC\"; ProcessName = \"winvnc\"; ExecutablePath = \"uvnc bvbaUltraVNCWinVNC.exe\" }\r\n        [PSCustomObject]@{Name = \"VNC Connect (RealVNC)\"; DisplayName = \"VNC Server\"; ProcessName = \"vncserver\"; ExecutablePath = \"RealVNCVNC Servervncserver.exe\" }\r\n        [PSCustomObject]@{Name = \"Zoho Assist\"; DisplayName = \"Zoho Assist Unattended Agent\"; ProcessName = \"ZohoURS\", \"ZohoURSService\"; ExecutablePath = \"ZohoMeetingUnAttendedZohoMeetingZohoURS.exe\", \"ZohoMeetingUnAttendedZohoMeetingZohoURSService.exe\" }\r\n        [PSCustomObject]@{Name = \"Atera\"; DisplayName = \"AteraAgent\"; ProcessName = \"AteraAgent\"; ExecutablePath = \"ATERA NetworksAteraAgentAteraAgent.exe\"}\r\n        [PSCustomObject]@{Name = \"Automate\"; DisplayName = \"Connectwise Automate\"; ProcessName = \"LTService\", \"LabTechService\"; SpecialExecutablePath = \"C:WindowsLTSvcLTSvc.exe\"}\r\n        [PSCustomObject]@{Name = \"Datto RMM\"; DisplayName = \"Datto RMM\"; ProcessName = \"AEMAgent\"; ExecutablePath = \"CentraStageAEMAgentAEMAgent.exe\", \"CentraStagegui.exe\"}\r\n        [PSCustomObject]@{Name = \"Kaseya\"; DisplayName = \"Kaseya Agent\"; ProcessName = \"AgentMon\", \"KaseyaRemoteControlHost\", \"Kasaya.AgentEndpoint\"; ExecutablePath = \"KaseyaAgentMonAgentMon.exe\"}\r\n        [PSCustomObject]@{Name = \"N-Able N-Central\"; DisplayName = \"Windows Agent\"; ProcessName = \"winagent\"; ExecutablePath = \"N-able TechnologiesWindows Agentwinagent.exe\"}\r\n        [PSCustomObject]@{Name = \"N-Able N-Sight\"; DisplayName = \"Advanced Monitoring Agent\"; ProcessName = \"winagent\"; ExecutablePath = \"Advanced Monitoring Agentwinagent.exe\", \"Advanced Monitoring Agent GPwinagent.exe\"}\r\n        [PSCustomObject]@{Name = \"Syncro\"; DisplayName = \"Syncro\",\"Kabuto\"; ProcessName = \"Syncro.App.Runner\", \"Kabuto.App.Runner\", \"Syncro.Service.Runner\", \"Kabuto.Service.Runner\", \"SyncroLive.Agent.Runner\", \"Kabuto.Agent.Runner\", \"SyncroLive.Agent.Service\", \"Syncro.Access.Service\", \"Syncro.Access.App\"; ExecutablePath = \"RepairTechSyncroSyncro.Service.Runner.exe\", \"RepairTechSyncroSyncro.App.Runner.exe\"}\r\n    )\r\n}\r\nprocess {\r\n\r\n    # Lets see what tools we don't want to alert on.\r\n    $ExcludedTools = New-Object System.Collections.Generic.List[String]\r\n\r\n    if ($ExcludeTools) {\r\n        $ExcludedTools.Add(($ExcludeTools.split(',')).Trim())\r\n    }\r\n\r\n    # Grabs the info we need from a textbox.\r\n    if ($env:ExcludeTools) {\r\n        $ExcludedTools.Add($env:ExcludeTools.split(','))\r\n    }\r\n\r\n    # For this kind of alert it might be worth it to create a whole custom field of ignorables.\r\n    if ($ExclusionsFromCustomField) {\r\n        $ExcludedTools.Add((Ninja-Property-Get $ExclusionsFromCustomField -split(',')).trim())\r\n    }\r\n\r\n    if ($env:ExclusionsFromCustomField) {\r\n        $ExcludedTools.Add((Ninja-Property-Get $env:ExclusionsFromCustomField -split(',')).trim())\r\n    }\r\n\r\n    if ($ExportCSV -or $Env:ExportCSV) {\r\n        $Format = \"csv\"\r\n\r\n        if ($ExportCSV) {\r\n            $ExportResults = $ExportCSV\r\n        }\r\n\r\n        if ($env:ExportCSV) {\r\n            $ExportResults = $env:ExportCSV\r\n        }\r\n    }elseif ($ExportJSON -or $env:ExportJSON) {\r\n        $Format = \"json\"\r\n\r\n        if ($ExportJSON) {\r\n            $ExportResults = $ExportJSON\r\n        }\r\n\r\n        if ($env:ExportJSON) {\r\n            $ExportResults = $env:ExportJSON\r\n        }\r\n    }\r\n\r\n    # This take's our list and begins searching by the 4 method's in the begin block. \r\n    $RemoteAccessTools = $RemoteToolList | ForEach-Object {\r\n\r\n        $UninstallKey = if ($_.DisplayName) {\r\n            $_.DisplayName | Find-UninstallKey\r\n        }\r\n        \r\n        $UninstallInfo = if ($_.DisplayName) {\r\n            $_.DisplayName | Find-UninstallKey -UninstallString\r\n        }\r\n        \r\n        $RunningStatus = if ($_.ProcessName) {\r\n            $_.ProcessName | Find-Process\r\n        }\r\n\r\n        $ServiceStatus = if($_.ProcessName) {\r\n            $_.ProcessName | Find-Service\r\n        }\r\n        \r\n        $InstallPath = if ($_.ExecutablePath) {\r\n            $_.ExecutablePath | Find-Executable\r\n        }elseif($_.SpecialExecutablePath){\r\n            $_.SpecialExecutablePath | Find-Executable -Special\r\n        }\r\n\r\n        if ($UninstallKey -or $RunningStatus -or $InstallPath -or $ServiceStatus) {\r\n            $Installed = \"Yes\"\r\n        }\r\n        else {\r\n            $Installed = \"No\"\r\n        }\r\n\r\n        [PSCustomObject]@{\r\n            Name              = $_.Name\r\n            Installed         = $Installed\r\n            CurrentlyRunning  = if ($RunningStatus) { \"Yes\" }else { \"No\" }\r\n            HasRunningService = if ($ServiceStatus) { \"Yes\" }else { \"No\" }\r\n            UninstallString   = $UninstallInfo\r\n            ExePath           = $InstallPath\r\n        } | Where-Object { $ExcludedTools -notcontains $_.Name }\r\n    }\r\n\r\n    $ActiveRemoteAccessTools = $RemoteAccessTools | Where-Object {$_.Installed -eq \"Yes\"}\r\n\r\n    # If we found anything in the three check's we're gonna indicate it's installed but we may also want to save our results to a custom field.\r\n    # We also may want to output more than \"We couldn't find any active remote access tools!\" in the event we find nothing.\r\n    if ($ShowNotFound -or $env:ShowNotFound) {\r\n\r\n        $RemoteAccessTools | Format-Table -Property Name, Installed, CurrentlyRunning, HasRunningService, UninstallString -AutoSize -Wrap | Out-String | Write-Host\r\n\r\n        if($ExportResults){\r\n            Export-CustomField -Name $ExportResults -Format $Format -Object ($RemoteAccessTools | Select-Object Name, Installed, CurrentlyRunning, HasRunningService)\r\n        }\r\n\r\n    }else{\r\n        if($ActiveRemoteAccessTools){\r\n\r\n            $ActiveRemoteAccessTools | Format-Table -Property Name, CurrentlyRunning, HasRunningService, UninstallString -AutoSize -Wrap | Out-String | Write-Host\r\n\r\n            if($ExportResults){\r\n                Export-CustomField -Name $ExportResults -Format $Format -Object ($ActiveRemoteAccessTools | Select-Object Name, CurrentlyRunning, HasRunningService)\r\n            }\r\n\r\n        }else{\r\n            Write-Host \"We couldn't find any active remote access tools!\"\r\n        }\r\n    }\r\n\r\n    if($ActiveRemoteAccessTools){\r\n        # We're going to set a failure status code in the event that we find something.\r\n        exit 1\r\n    }\r\n    else {\r\n        exit 0\r\n    }\r\n}<\/pre>\n<p>&nbsp;<\/p>\n\n<div class=\"in-context-cta\"><p style=\"text-align: center;\">Acesse mais de 300 scripts no NinjaOne Dojo<\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.ninjaone.com\/freetrialform\/\">Obter acesso<\/a><\/p>\n<\/div>\n<h2>Detalhamento<\/h2>\n<p>A detec\u00e7\u00e3o de software de acesso remoto envolve algumas etapas cr\u00edticas:<\/p>\n<ul>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><strong>Monitoramento do tr\u00e1fego de rede<\/strong>: Comece monitorando o tr\u00e1fego da rede. Padr\u00f5es incomuns ou <a href=\"https:\/\/www.ninjaone.com\/it-hub\/gerenciamento-de-servicos-de-ti\/what-is-an-ip-address\/\">endere\u00e7os IP<\/a> desconhecidos podem ser indicadores.<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><strong>Processos e tarefas do sistema<\/strong>: A verifica\u00e7\u00e3o regular dos processos ativos do sistema pode ajudar a identificar ferramentas n\u00e3o autorizadas. Qualquer processo desconhecido merece uma investiga\u00e7\u00e3o mais aprofundada.<\/li>\n<li data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><strong>Auditoria de software<\/strong>: Usando ferramentas internas do sistema, como o &#8220;Gerenciador de tarefas&#8221; para Windows ou o &#8220;Monitor de atividade&#8221; para macOS, \u00e9 poss\u00edvel obter uma lista de todos os aplicativos instalados. A procura por softwares desconhecidos pode, \u00e0s vezes, revelar a presen\u00e7a de ferramentas de acesso remoto.<\/li>\n<\/ul>\n<h2>Casos de uso em potencial<\/h2>\n<p>Considere Alex, um profissional de TI em uma empresa de m\u00e9dio porte. Ela percebe que a largura de banda da rede est\u00e1 aumentando durante o hor\u00e1rio n\u00e3o comercial. Ap\u00f3s uma investiga\u00e7\u00e3o mais aprofundada, ela identifica um endere\u00e7o IP desconhecido acessando consistentemente a rede. Usando ferramentas de auditoria do sistema, ela descobre um software de acesso remoto instalado em v\u00e1rios sistemas do escrit\u00f3rio que ningu\u00e9m se lembra de ter instalado. Ao identificar e remover esse software, Alex impediu uma poss\u00edvel <a href=\"https:\/\/www.ninjaone.com\/it-hub\/endpoint-security\/what-is-a-data-breach\/\">viola\u00e7\u00e3o de dados<\/a>.<\/p>\n<h2>Compara\u00e7\u00f5es<\/h2>\n<p>Os m\u00e9todos tradicionais de detec\u00e7\u00e3o de ferramentas de acesso remoto incluem auditorias manuais, verifica\u00e7\u00e3o de registros de firewall ou depend\u00eancia de software antiv\u00edrus. Embora esses m\u00e9todos possam ser eficazes, eles n\u00e3o s\u00e3o infal\u00edveis. A abordagem do script automatiza o processo de detec\u00e7\u00e3o, tornando-o abrangente e eficiente em termos de tempo. Esse m\u00e9todo proativo pode, com frequ\u00eancia, capturar RATs mais novas e mais sofisticadas que podem contornar os m\u00e9todos convencionais.<\/p>\n<div class=\"in-context-cta\"><p style=\"text-align: left;\">Ter a capacidade de detectar quando um software remoto n\u00e3o aprovado \u00e9 instalado em um computador \u00e9 fundamental para manter seguros os dispositivos, a rede mais ampla e os dados da sua organiza\u00e7\u00e3o.<\/p>\n<p style=\"text-align: left;\"><a href=\"https:\/\/www.ninjaone.com\/blog\/what-is-shadow-it\/\">Shadow IT<\/a> refere-se a sistemas, dispositivos, software ou aplicativos que s\u00e3o usados e gerenciados fora do alcance oficial do departamento de TI da sua organiza\u00e7\u00e3o. Isso geralmente ocorre quando os funcion\u00e1rios usam suas pr\u00f3prias solu\u00e7\u00f5es ou tecnologias sem aprova\u00e7\u00e3o ou supervis\u00e3o expl\u00edcita. Nesse caso, qualquer software remoto que seja instalado sem o conhecimento da organiza\u00e7\u00e3o \u00e9 um exemplo de Shadow IT. Quando isso acontece, apresenta v\u00e1rios desafios cr\u00edticos:<\/p>\n<ul>\n<li><strong>Falta de supervis\u00e3o do departamento de TI: <\/strong>Quando o software remoto \u00e9 instalado inadvertidamente no(s) dispositivo(s), ele geralmente ignora os protocolos padr\u00e3o de seguran\u00e7a, governan\u00e7a de dados e conformidade que podem ser configurados na organiza\u00e7\u00e3o.<\/li>\n<li><strong>Riscos de seguran\u00e7a: <\/strong>Como o software remoto n\u00e3o foi submetido \u00e0 mesma medida de seguran\u00e7a que os recursos de TI autorizados, ele pode introduzir vulnerabilidades (o departamento de TI n\u00e3o pode corrigir um software que desconhece) que podem causar viola\u00e7\u00f5es de dados ou incidentes de seguran\u00e7a<\/li>\n<li><strong>Risco do fornecedor: <\/strong>Alguns fornecedores t\u00eam camadas de seguran\u00e7a melhores do que outros. A introdu\u00e7\u00e3o de software, especialmente software remoto, em que os fornecedores n\u00e3o foram adequadamente examinados, pode introduzir riscos adicionais para a organiza\u00e7\u00e3o e at\u00e9 mesmo colocar sua organiza\u00e7\u00e3o em risco de falhar nas avalia\u00e7\u00f5es de conformidade ou seguran\u00e7a<\/li>\n<\/ul>\n<p style=\"text-align: left;\">Esse script pode ajudar detectando a partir de uma lista conhecida de <a href=\"https:\/\/www.ninjaone.com\/remote-access\/\">software de acesso remoto<\/a> e acionando quando detecta algo que n\u00e3o est\u00e1 na lista autorizada. Al\u00e9m dos problemas de seguran\u00e7a, h\u00e1 outros benef\u00edcios nesse tipo de detec\u00e7\u00e3o:<\/p>\n<div class=\"elementToProof\">\n<ul>\n<li>Para os MSPs, isso pode ser uma boa indica\u00e7\u00e3o inicial de que seu cliente est\u00e1 se envolvendo com outro MSP ou empresa de TI<\/li>\n<li>Ele pode ajudar a identificar resqu\u00edcios de softwares antigos de acesso remoto que est\u00e3o instalados na rede<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Considera\u00e7\u00f5es finais<\/h2>\n<p><a href=\"https:\/\/www.ninjaone.com\/remote-access\/\">O software de acesso remoto<\/a> n\u00e3o detectado pode levar a viola\u00e7\u00f5es significativas, roubo de dados ou at\u00e9 mesmo <a href=\"https:\/\/www.ninjaone.com\/pt-br\/blog\/como-detectar-o-ransomware\/\">ataques de ransomware<\/a>. \u00c0 medida que mais empresas migram para o ambiente on-line, garantir a seguran\u00e7a de cada endpoint se torna uma tarefa fundamental. N\u00e3o levar isso a s\u00e9rio pode ter repercuss\u00f5es financeiras, operacionais e de reputa\u00e7\u00e3o.<\/p>\n","protected":false},"author":35,"featured_media":143987,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[12456],"class_list":["post-809720","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/script_hub\/809720","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/comments?post=809720"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/media\/143987"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/media?parent=809720"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/operating_system?post=809720"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/use_cases?post=809720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}