Welcome to LOLRMM (Living Off the Land Remote Monitoring and Management), a community-driven project that provides a curated list of Remote Monitoring and Management (RMM) tools that could potentially be abused by threat actors. Our mission is to assist security professionals in staying informed about these tools and their potential for misuse, providing the community a catalog of these tools which can be used for threat hunting, detection and prevention policy creations.
To begin working with LOLRMM, you can:
To fetch the complete list of RMM tools in JSON format, you can use the following curl command:
curl https://lolrmm.io/api/rmm_tools.json
This will return a JSON array containing detailed information about all cataloged RMM tools.
For CSV format, simply change the extension to .csv
:
curl https://lolrmm.io/api/rmm_tools.csv
These APIs provide an easy way to integrate LOLRMM data into your threat hunting, detection, and prevention workflows.
Please use the GitHub issue tracker to submit bugs or request features.
Stay engaged with the LOLRMM community by regularly checking for updates and contributing to the project. Your involvement will help ensure the project remains up-to-date and even more valuable to others.
If you'd like to contribute, please follow these steps:
For more detailed instructions, please refer to the CONTRIBUTING.md file (if available). To create a new YAML file for an RMM tool, use the provided YAML templates in the yaml
directory.
LOLRMM provides Sigma detection rules to help you effectively detect potential threats related to RMM tools. To explore these rules in detail, navigate to the detections/sigma/
directory.
Happy hunting! 🕵️♂️
Clone the repository:
git clone https://github.com/magicsword-io/LOLRMM.git
Change to the project directory:
cd LOLRMM
Install dependencies:
poetry install
Activate the virtual environment:
poetry shell
Build the site using the files under the /yaml folder:
python bin/site.py
Change to the website directory and install dependencies:
cd website && pnpm i
Run the website locally:
pnpm dev
Visit http://localhost:3000
in your browser to view the site.
Join us in our quest to create a safer and more secure digital environment for organizations everywhere. With LOLRMM by your side, you'll be well-equipped to understand and address the potential risks associated with RMM tools in the ever-evolving cyber landscape.