Komari: The “Monitoring” Tool That Didn’t Need Weaponising

SOC Prime Team

Komari: The “Monitoring” Tool That Didn’t Need Weaponising

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

A threat actor used stolen VPN credentials to access a Huntress partner’s Windows workstation, then enabled RDP and deployed the open-source Komari monitoring agent as a SYSTEM-level service disguised as Windows Update Service through NSSM. Once installed, the agent established a persistent WebSocket connection to attacker-controlled infrastructure and provided capabilities such as command execution, terminal access, and heartbeat-style pinging. In practice, the tool functioned as a lightweight command-and-control framework without requiring additional weaponization.

Investigation

The intrusion began with an SSL VPN login originating from 45.153.34.132, followed by the use of Impacket’s smbexec.py to enable RDP and run a series of remote commands. Investigators found that a PowerShell one-liner downloaded the Komari installer directly from GitHub and registered it as a Windows service. That service then launched komari-agent.exe, opened a WebSocket session to the attacker’s server, and enabled arbitrary remote command execution on the host.

Mitigation

Huntress responded by isolating the compromised workstation, disabling the affected user account, and stopping the NSSM-created Komari service. The malicious WebSocket connection was blocked, and the persistence mechanism was removed from the system. Recommended follow-up defenses include tightening VPN access controls, monitoring for suspicious service creation events, inspecting outbound WebSocket activity, and strengthening RDP security.

Response

Defenders should detect creation of a Windows service named Windows Update Service that points to komari-agent.exe, monitor for long-lived outbound WebSocket connections to unfamiliar hosts, and alert on the use of Impacket tools such as smbexec.py for lateral movement. If identified, the affected endpoint should be contained immediately, compromised credentials revoked, and the rogue service removed from the environment.

graph TB %% Class Definitions classDef action fill:#99ccff classDef technique fill:#ffcc99 classDef tool fill:#cccccc classDef process fill:#e6e6fa %% Nodes – Actions / Techniques action_initial_access[“Action – T1078 Valid Accounts Description: Use stolen VPN credentials to establish an SSLVPN session and gain initial access.”] class action_initial_access technique action_cred_dump[“Action – T1552.002 Unsecured Credentials Description: Dump SAM, System and Security registry hives to obtain password hashes.”] class action_cred_dump technique action_enable_rdp[“Action – T1599 Network Boundary Bridging Description: Modify the registry key fDenyTSConnections to enable Remote Desktop Protocol access.”] class action_enable_rdp technique action_firewall_rule[“Action – T1562.004 Impair Defenses Description: Create a firewall rule named Allow RDP that opens inbound TCP port 3389.”] class action_firewall_rule technique %% Nodes – Tools / Processes tool_vpn[“Tool – Name: VPN Client Purpose: Connect to corporate network via SSLVPN.”] class tool_vpn tool process_regdump[“Process – Command: reg save HKLM\\SYSTEM\\… Description: Dump SAM, System and Security hives.”] class process_regdump process process_reg_modify[“Process – Command: reg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server /v fDenyTSConnections /t REG_DWORD /d 0 /f Description: Enable RDP through registry modification.”] class process_reg_modify process process_fw_rule[“Process – Command: netsh advfirewall firewall add rule name=\”Allow RDP\” dir=in action=allow protocol=TCP localport=3389 Description: Add firewall rule to allow inbound RDP traffic.”] class process_fw_rule process %% Connections action_initial_access –>|uses| tool_vpn action_initial_access –>|leads to| action_cred_dump action_cred_dump –>|uses| process_regdump action_cred_dump –>|leads to| action_enable_rdp action_enable_rdp –>|uses| process_reg_modify action_enable_rdp –>|leads to| action_firewall_rule action_firewall_rule –>|uses| process_fw_rule

Komari: The “Monitoring” Tool That Didn’t Need Weaponising

Summary

Investigation

Mitigation

Response

Attack Flow

Detections

Possible Impacket Command Line Patterns (via cmdline)

Possible Remote Code Execution using Impacket (via cmdline)

Powershell Executing File In Suspicious Directory Using Bypass Execution Policy (via cmdline)

Download or Upload via Powershell (via cmdline)

Possible Remote Desktop Services Shadowing (via process_creation)

Suspicious Firewall Modifications via CLI (via cmdline)

Suspicious Process Utilizes a URL in the Command Line (via cmdline)

Alternative Remote Access / Management Software (via process_creation)

IOCs (HashSha256) to detect: Komari: The “Monitoring” Tool That Didn’t Need Weaponising

IOCs (SourceIP) to detect: Komari: The “Monitoring” Tool That Didn’t Need Weaponising

IOCs (DestinationIP) to detect: Komari: The “Monitoring” Tool That Didn’t Need Weaponising

Detection of Impacket smbexec.py and cmd.exe Execution via RDP [Windows Process Creation]

PowerShell Execution for Komari Agent Installation [Windows Powershell]

Detect Komari Agent Persistence via Windows Update Service [Windows System]

Detection of Unauthorized SSLVPN Access and Post-Compromise Activity [Firewall]

Simulation Execution