ZeroTier Coverage

RMM/ZeroTier/RMM_AHQ_ZeroTier.md

@@ -0,0 +1,54 @@
+# Advanced Hunting Query for ZeroTier
+
+### Create Process 
+```
+let Time_start = now(-5d);
+let Time_end = now();
+//
+let rmmProcess = 
+DeviceProcessEvents 
+| where Timestamp between (Time_start..Time_end)
+ | where CreatedProcessVersionInfoCompanyName has "zerotier" and InitiatingProcessVersionInfoCompanyName has 'zerotier'
+        or  
+        InitiatingProcessVersionInfoProductName has 'zerotier'  
+| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
+    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName, AccountUpn 
+| extend rmmProcessName = 'ZeroTier' 
+; 
+rmmProcess
+```
+
+### File Signature
+```
+let Time_start = now(-5d);
+let Time_end = now();
+//
+let rmmFileSig = 
+DeviceFileCertificateInfo
+| where Timestamp between (Time_start..Time_end)
+| where Signer has 'Zerotier'
+| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
+    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName
+| extend rmmFileSigName = 'ZeroTier' 
+;
+rmmFileSig
+```
+
+### Network Connection
+```
+let Time_start = now(-5d);
+let Time_end = now();
+//
+let rmmNetwork = 
+DeviceNetworkEvents
+| where Timestamp between (Time_start..Time_end)
+| where RemoteUrl has 'zerotier.com'
+    and InitiatingProcessVersionInfoCompanyName has 'ZeroTier'
+    and InitiatingProcessVersionInfoProductName has 'ZeroTier'
+| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
+    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
+    AccountUpn, RemoteUrl 
+| extend rmmNetworkName = 'ZeroTier'
+;
+rmmNetwork
+```

RMM/ZeroTier/RMM_Summary_ZeroTier.md

@@ -0,0 +1,22 @@
+# Remote Monitioring and Management (RMM) Tool Summary for UltraViewer
+
+### Company/ Project website:
+- https://www.zerotier.com/
+
+### Historical context and detail
+- 
+
+### Process Indicators
+- 
+- 
+- 
+
+### Network Indicators
+- zerotier.com
+- 
+-
+
+### File Signature Indicators
+- Zerotier 
+- ZeroTier, Inc
+- ZeroTier One