src/Private/Patterns/RemoteAccessToolNames.txt

# Substring matches (case-insensitive) against installed software, process path, or service path.
# Hits are presence indicators, not proof of abuse. Admin RMM, PuTTY, WinSCP, and FileZilla match too.
teamviewer
anydesk
ammyy
atera
screenconnect
connectwise
logmein
gotoassist
splashtop
radmin
vnc
ngrok
chrome remote desktop
supremo
dwservice
rustdesk
netsupport
remoteutilities
zoho assist
pulseway
level.io
tacticalrmm
psexec
rclone
megasync
filezilla
winscp
putty
tor browser
advanced ip scanner
angry ip