Add README, .gitignore, and refactor common detection constants

.gitignore

@@ -0,0 +1,4 @@
+.idea
+*.html
+*.json
+*.exe

README.md

@@ -0,0 +1,175 @@
+# RMM-Hunter
+
+A comprehensive Windows security tool designed to detect and analyze Remote Monitoring and Management (RMM) software deployments across enterprise environments.
+
+![](.img/banner-metadata.png)
+
+## Overview
+
+RMM-Hunter is a forensic analysis tool that identifies potentially malicious or unauthorized Remote Monitoring and Management software on Windows systems. Built on a proprietary detection framework called **Scurvy** (private repository), RMM-Hunter provides security teams with comprehensive visibility into RMM installations that may pose security risks or compliance concerns.
+
+## Features
+
+### Hunt Module
+
+The hunt module performs deep system analysis across multiple detection vectors:
+
+- **Process Analysis** - Identifies suspicious running processes associated with known RMM tools
+- **Service Enumeration** - Detects RMM-related Windows services, including those in unusual installation paths
+- **Binary Discovery** - Locates RMM executables across common and uncommon installation directories
+- **Registry Analysis** - Examines autorun entries and persistence mechanisms
+- **Network Connection Monitoring** - Identifies active outbound connections to known RMM infrastructure
+- **Scheduled Task Detection** - Discovers RMM-related scheduled tasks used for persistence
+- **Directory Scanning** - Searches for RMM installation directories and artifacts
+
+![](.img/hunt.png)
+
+### Detection Capabilities
+
+RMM-Hunter maintains an extensive signature database covering:
+
+- TeamViewer, AnyDesk, LogMeIn, ScreenConnect
+- Remote Utilities, UltraVNC, RealVNC, TightVNC
+- Atera, NinjaRMM, ConnectWise, Syncro
+- 500+ additional RMM tools and variants
+
+The tool implements intelligent filtering to reduce false positives while flagging suspicious installation paths and configurations.
+
+### Reporting
+
+RMM-Hunter generates comprehensive reports in multiple formats:
+
+- **JSON** - Machine-readable format for integration with SIEM and automation platforms
+- **HTML** - Interactive web-based report with filtering and search capabilities
+
+![](.img/findings.png)
+
+The HTML report includes:
+- Executive summary with detection statistics
+- Detailed findings across all detection categories
+- Metadata including detection time and system information
+- Built-in search and filter functionality for large result sets
+
+![](.img/search-filter.png)
+
+## Installation
+
+### Prerequisites
+
+- Windows Operating System (Windows 10/11 or Windows Server 2016+)
+- Administrator privileges (required for service and process enumeration)
+- Go 1.24+ (for building from source)
+
+### Binary Download
+
+Download the latest compiled binary from the releases page:
+```
+
+powershell
+Download rmm-hunter.exe
+Run with administrator privileges```
+
+### Building from Source
+```
+
+The Scurvy Library is not publicly accessible making building this tool from source impossible at the moment.
+
+## Usage
+
+### Hunt Mode
+
+Execute a comprehensive system scan:
+```
+
+powershell .\rmm-hunter.exe hunt```
+
+With custom output file:
+```
+
+powershell .\rmm-hunter.exe hunt --output custom-report.json``` 
+
+Exclude specific RMM tools from detection:
+```
+
+powershell .\rmm-hunter.exe hunt --exclude TeamViewer,AnyDesk```
+
+### Eliminate Mode
+
+**Status: Under Construction**
+
+The elimination module is currently under active development. This functionality will provide automated remediation capabilities for detected RMM installations.
+
+Planned features:
+- Service termination and removal
+- Process termination
+- Binary deletion
+- Registry cleanup
+- Scheduled task removal
+- Backup and rollback capabilities
+
+## Architecture
+
+RMM-Hunter is built on **Scurvy**, a proprietary Windows system analysis framework (private repository). Scurvy provides the core capabilities for:
+
+- Low-level Windows API interactions
+- Process and service management
+- Registry operations
+- Network connection enumeration
+- WMI query execution
+
+The modular architecture allows for extensible detection capabilities while maintaining performance and stability.
+
+## Output Formats
+
+### JSON Report
+```
+
+json { "processes": [...], "services": [...], "binaries": [...], "autoRuns": [...], "scheduledTasks": [...], "outboundConnections": [...], "directories": [...] }``` 
+
+### HTML Report
+
+Interactive web-based report with:
+- Sortable tables
+- Real-time search filtering
+- Category-based navigation
+- Responsive design for mobile viewing
+
+## Detection Methodology
+
+RMM-Hunter employs multiple detection strategies:
+
+1. **Signature-based Detection** - Matches against known RMM executable names and paths
+2. **Behavioral Analysis** - Identifies suspicious installation locations and configurations
+3. **Network Indicators** - Detects connections to known RMM infrastructure domains
+4. **Persistence Mechanisms** - Analyzes autorun entries and scheduled tasks
+
+## Limitations
+
+- Requires administrative privileges for complete system visibility
+- May generate false positives in environments with legitimate RMM deployments
+- Network detection requires active connections at scan time
+- Elimination functionality not yet available
+
+## Contributing
+
+Contributions are welcome. Please submit pull requests with:
+- Detailed description of changes
+- Test coverage for new detection signatures
+- Documentation updates
+
+## License
+
+[Your License Here]
+
+## Disclaimer
+
+This tool is intended for authorized security assessments and forensic analysis only. Users are responsible for ensuring compliance with applicable laws and regulations. Unauthorized use of this tool may violate computer fraud and abuse laws.
+
+## Support
+
+For issues, questions, or feature requests, please open an issue on the GitHub repository.
+
+---
+
+**Note**: The underlying Scurvy framework is not publicly accessible and is maintained in a private repos
+

internal/pkg/hunt/detect/autorun/autorun.go

@@ -104,7 +104,7 @@ func isSuspiciousAutoRun(name, command string) bool {
 	}
 
 	// Check against common Suspicious executable patterns
-	for _, imageEnd := range common.CommonImageEnds {
+	for _, imageEnd := range common.CommonImageSuffixes {
 		imageEndLower := strings.ToLower(imageEnd)
 		if strings.Contains(commandLower, imageEndLower) {
 			return true

internal/pkg/hunt/detect/binaries/binaries.go

@@ -73,8 +73,8 @@ func searchDirectory(dir string, resultChan chan<- string) {
 			return nil
 		}
 
-		// Check if the file path ends with any CommonImageEnds
-		for _, imageEnd := range common.CommonImageEnds {
+		// Check if the file path ends with any CommonImageSuffixes
+		for _, imageEnd := range common.CommonImageSuffixes {
 			// Normalize path separators and make case-insensitive comparison
 			normalizedPath := strings.ToLower(filepath.ToSlash(path))
 			normalizedImageEnd := strings.ToLower(filepath.ToSlash(imageEnd))

internal/pkg/hunt/detect/common/directories.go

@@ -0,0 +1,78 @@
+package common
+
+var CommonDirectories = []string{
+	`C:\Program Files (x86)%\mRemoteNG`,
+	`C:\\Program Files (x86)\Sysprogs`,
+	`C:\\Program Files (x86)\Sysprogs\SmarTTY`,
+	`C:\AlpemixSrvc`,
+	`C:\Downloads\SuperPuTTY`,
+	`C:\Program Files (x86)\Almageste\DragonDisk`,
+	`C:\Program Files (x86)\AnyDesk`,
+	`C:\Program Files (x86)\AnyViewer`,
+	`C:\Program Files (x86)\Atera Networks`,
+	`C:\Program Files (x86)\Bitvise SSH Client`,
+	`C:\Program Files (x86)\Bluetrait Agent`,
+	`C:\Program Files (x86)\DesktopCentral_Agent`,
+	`C:\Program Files (x86)\DesktopCentral_Agent\bin`,
+	`C:\Program Files (x86)\GoTo Opener`,
+	`C:\Program Files (x86)\GoToMyPC`,
+	`C:\Program Files (x86)\Google\Chrome Remote Desktop`,
+	`C:\Program Files (x86)\ISL Online`,
+	`C:\Program Files (x86)\Kaseya`,
+	`C:\Program Files (x86)\LANDesk`,
+	`C:\Program Files (x86)\OnionShare`,
+	`C:\Program Files (x86)\NetSarang`,
+	`C:\Program Files (x86)\NetSarang\xShell`,
+	`C:\Program Files (x86)\PJ Technologies`,
+	`C:\Program Files (x86)\PJ Technologies\GOVsrv`,
+	`C:\Program Files (x86)\Radmin Viewer 3`,
+	`C:\Program Files (x86)\RemotePC`,
+	`C:\Program Files (x86)\S3 Browser`,
+	`C:\Program Files (x86)\ScreenConnect Client (`, // C:\Program Files (x86)\ScreenConnect Client (<string ID>)
+	`C:\Program Files (x86)\SmartFTP Client`,
+	`C:\Program Files (x86)\Splashtop`,
+	`C:\Program Files (x86)\TeamViewer`,
+	`C:\Program Files (x86)\UltraViewer`,
+	`C:\Program Files (x86)\Xpra`,
+	`C:\Program Files (x86)\Yandex`,
+	`C:\Program Files (x86)\mRemoteNG`,
+	`C:\Program Files\ATERA NETWORKS`,
+	`C:\Program Files\ATERA NETWORKS\AteraAgent`,
+	`C:\Program Files\AnyDesk`,
+	`C:\Program Files\Bitvise SSH Server`,
+	`C:\Program Files\Danware Data\NetOp Packn Deploy`,
+	`C:\Program Files\Level`,
+	`C:\\Program Files\\LiteManager Pro`,
+	`C:\\Program Files\\LiteManager Pro \u2013 Viewer`,
+	`C:\Program Files\ManageEngine\ManageEngine Free Tools`,
+	`C:\Program Files\ManageEngine\ManageEngine Free Tools\Launcher`,
+	`C:\Program Files\RealVNC`,
+	`C:\Program Files\RealVNC\VNC Serve`,
+	`C:\Program Files\Remote Utilities`,
+	`C:\Program Files\Remote Utilities\Agent`,
+	`C:\Program Files\Solar-Putty-v4`,
+	`C:\Program Files\SolarWinds\Dameware Mini Remote Control`,
+	`C:\Program Files\SysAidServer`,
+	`C:\Program Files\TeamViewer`,
+	`C:\Program Files\TightVNC`,
+	`C:\Program Files\ZOC8`,
+	`C:\Program Files\uvnc bvba`,
+	`C:\Program Files\uvnc bvba\UltraVNC`,
+	`C:\ProgramData\Kaseya`,
+	`C:\ProgramData\Total Software Deployment`,
+	`C:\ProgramFiles\GoTo Machine Installer`,
+	`C:\ProgramFiles (x86)\GoTo Machine Installer`,
+	`{{APPDATA}}\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd`,
+	`{{APPDATA}}\Local\MEGAsync`,
+	`{{APPDATA}}\Roaming\Mikogo`,
+	`{{APPDATA}}\Roaming\SyncTrayzor`,
+	`C:\Users\IEUser\Downloads\WinSCP-5.21.6-Portable`,
+	`C:\Users\USERNAME\AppData\Roaming\Insync`,
+	`C:\Users\USERNAME\AppData\Roaming\Insync\App`,
+	`C:\Windows\Action1`,
+	`C:\Windows\SysWOW64\rserver30`,
+	`C:\Windows\SysWOW64\rserver30\FamItrfc`,
+	`C:\Windows\SysWOW64\rserver30\FamItrf2`,
+	`C:\Windows\dwrcs`,
+	`C:\ProgramData\AMMYY`,
+}

internal/pkg/hunt/detect/common/imageSuffixes.go

@@ -1,94 +1,6 @@
 package common
 
-var CommonDirectories = []string{
-	`C:\Program Files (x86)%\mRemoteNG`,
-	`C:\\Program Files (x86)\Sysprogs`,
-	`C:\\Program Files (x86)\Sysprogs\SmarTTY`,
-	`C:\AlpemixSrvc`,
-	`C:\Downloads\SuperPuTTY`,
-	`C:\Program Files (x86)\Almageste\DragonDisk`,
-	`C:\Program Files (x86)\AnyDesk`,
-	`C:\Program Files (x86)\AnyViewer`,
-	`C:\Program Files (x86)\Atera Networks`,
-	`C:\Program Files (x86)\Bitvise SSH Client`,
-	`C:\Program Files (x86)\Bluetrait Agent`,
-	`C:\Program Files (x86)\DesktopCentral_Agent`,
-	`C:\Program Files (x86)\DesktopCentral_Agent\bin`,
-	`C:\Program Files (x86)\GoTo Opener`,
-	`C:\Program Files (x86)\GoToMyPC`,
-	`C:\Program Files (x86)\Google\Chrome Remote Desktop`,
-	`C:\Program Files (x86)\ISL Online`,
-	`C:\Program Files (x86)\Kaseya`,
-	`C:\Program Files (x86)\LANDesk`,
-	`C:\Program Files (x86)\OnionShare`,
-	`C:\Program Files (x86)\NetSarang`,
-	`C:\Program Files (x86)\NetSarang\xShell`,
-	`C:\Program Files (x86)\PJ Technologies`,
-	`C:\Program Files (x86)\PJ Technologies\GOVsrv`,
-	`C:\Program Files (x86)\Radmin Viewer 3`,
-	`C:\Program Files (x86)\RemotePC`,
-	`C:\Program Files (x86)\S3 Browser`,
-	`C:\Program Files (x86)\ScreenConnect Client (`, // C:\Program Files (x86)\ScreenConnect Client (<string ID>)
-	`C:\Program Files (x86)\SmartFTP Client`,
-	`C:\Program Files (x86)\Splashtop`,
-	`C:\Program Files (x86)\TeamViewer`,
-	`C:\Program Files (x86)\UltraViewer`,
-	`C:\Program Files (x86)\Xpra`,
-	`C:\Program Files (x86)\Yandex`,
-	`C:\Program Files (x86)\mRemoteNG`,
-	`C:\Program Files\ATERA NETWORKS`,
-	`C:\Program Files\ATERA NETWORKS\AteraAgent`,
-	`C:\Program Files\AnyDesk`,
-	`C:\Program Files\Bitvise SSH Server`,
-	`C:\Program Files\Danware Data\NetOp Packn Deploy`,
-	`C:\Program Files\Level`,
-	`C:\\Program Files\\LiteManager Pro`,
-	`C:\\Program Files\\LiteManager Pro \u2013 Viewer`,
-	`C:\Program Files\ManageEngine\ManageEngine Free Tools`,
-	`C:\Program Files\ManageEngine\ManageEngine Free Tools\Launcher`,
-	`C:\Program Files\RealVNC`,
-	`C:\Program Files\RealVNC\VNC Serve`,
-	`C:\Program Files\Remote Utilities`,
-	`C:\Program Files\Remote Utilities\Agent`,
-	`C:\Program Files\Solar-Putty-v4`,
-	`C:\Program Files\SolarWinds\Dameware Mini Remote Control`,
-	`C:\Program Files\SysAidServer`,
-	`C:\Program Files\TeamViewer`,
-	`C:\Program Files\TightVNC`,
-	`C:\Program Files\ZOC8`,
-	`C:\Program Files\uvnc bvba`,
-	`C:\Program Files\uvnc bvba\UltraVNC`,
-	`C:\ProgramData\Kaseya`,
-	`C:\ProgramData\Total Software Deployment`,
-	`C:\ProgramFiles\GoTo Machine Installer`,
-	`C:\ProgramFiles (x86)\GoTo Machine Installer`,
-	`{{APPDATA}}\Local\Google\Chrome\User Data\Default\Extensions\iodihamcpbpeioajjeobimgagajmlibd`,
-	`{{APPDATA}}\Local\MEGAsync`,
-	`{{APPDATA}}\Roaming\Mikogo`,
-	`{{APPDATA}}\Roaming\SyncTrayzor`,
-	`C:\Users\IEUser\Downloads\WinSCP-5.21.6-Portable`,
-	`C:\Users\USERNAME\AppData\Roaming\Insync`,
-	`C:\Users\USERNAME\AppData\Roaming\Insync\App`,
-	`C:\Windows\Action1`,
-	`C:\Windows\SysWOW64\rserver30`,
-	`C:\Windows\SysWOW64\rserver30\FamItrfc`,
-	`C:\Windows\SysWOW64\rserver30\FamItrf2`,
-	`C:\Windows\dwrcs`,
-	`C:\ProgramData\AMMYY`,
-}
-
-var CommonRMMs = []string{
-	"GoToRemote",
-	"LogMeIn",
-	"ScreenConnect",
-	"Screen Connect",
-	"RustDesk",
-	"Rust Desk",
-	"TeamViewer",
-	"Team Viewer",
-}
-
-var CommonImageEnds = []string{
+var CommonImageSuffixes = []string{
 	"\\9380CC75B872221A7425D7503565B67580407F60",
 	"\\AEMAgent.exe",
 	"\\AMMYY_Admin.exe",

internal/pkg/hunt/detect/common/rmmNames.go

@@ -0,0 +1,503 @@
+package common
+
+var CommonRMMs = []string{
+	// A
+	"Action1",
+	"Action1RMM",
+	"Action 1",
+	"Action 1 RMM",
+	"AeroAdmin",
+	"Aero Admin",
+	"Alpemix",
+	"AMMYY",
+	"AMMYY Admin",
+	"AMMYYAdmin",
+	"Atera",
+	"AteraAgent",
+	"Atera Agent",
+	"AnyDesk",
+	"Any Desk",
+	"AnyViewer",
+	"Any Viewer",
+	"AnyPlace Control",
+	"AnyPlaceControl",
+	"AweSun",
+	"Awe Sun",
+	"Auvik",
+
+	// B
+	"BeamYourScreen",
+	"Beam Your Screen",
+	"BeAnywhere",
+	"Be Anywhere",
+	"Bitvise",
+	"Bitvise SSH",
+	"BitviseSSH",
+	"Bluetrait",
+	"Bluetrait Agent",
+	"BluetraitAgent",
+	"Bomgar",
+	"BeyondTrust",
+	"Beyond Trust",
+
+	// C
+	"Chrome Remote Desktop",
+	"ChromeRemoteDesktop",
+	"Cloudberry",
+	"CloudBerry",
+	"Cloud Berry",
+	"Comodo One",
+	"ComodoOne",
+	"Comodo RMM",
+	"ComodoRMM",
+	"ConnectWise",
+	"ConnectWise Control",
+	"ConnectWiseControl",
+	"Connect Wise",
+	"ScreenConnect",
+	"Screen Connect",
+	"CrossLoop",
+	"Cross Loop",
+
+	// D
+	"Dameware",
+	"Dameware Remote",
+	"DamewareRemote",
+	"Datto RMM",
+	"DattoRMM",
+	"Datto",
+	"DesktopCentral",
+	"Desktop Central",
+	"Deskroll",
+	"Desk Roll",
+	"Distant Desktop",
+	"DistantDesktop",
+	"Domotz",
+	"DWAgent",
+	"DW Agent",
+	"DWService",
+	"DW Service",
+
+	// E
+	"Ehorus",
+	"Ericom Connect",
+	"EricomConnect",
+
+	// F
+	"FastViewer",
+	"Fast Viewer",
+	"FixMeIT",
+	"Fix Me IT",
+	"FixMeIt",
+	"FleetDeck",
+	"Fleet Deck",
+
+	// G
+	"GetScreen",
+	"Get Screen",
+	"GoTo",
+	"GoToAssist",
+	"GoTo Assist",
+	"GoToMyPC",
+	"GoTo MyPC",
+	"GoToRemote",
+	"GoTo Remote",
+	"Goverlan",
+	"GovReach",
+	"Gov Reach",
+
+	// H
+	"HelpU",
+	"Help U",
+
+	// I
+	"ISL Online",
+	"ISLOnline",
+	"ISL Light",
+	"ISLLight",
+	"Impero",
+	"Impero Connect",
+	"ImperoConnect",
+	"Insync",
+	"InstantHousecall",
+	"Instant Housecall",
+	"Iperius",
+	"Iperius Remote",
+	"IperiusRemote",
+	"iTarian",
+	"Ivanti",
+	"Ivanti Neurons",
+	"IvantiNeurons",
+
+	// J
+	"JumpCloud",
+	"Jump Cloud",
+	"JumpDesktop",
+	"Jump Desktop",
+
+	// K
+	"Kabuto",
+	"Kaseya",
+	"Kaseya VSA",
+	"KaseyaVSA",
+	"Kickidler",
+
+	// L
+	"LANDesk",
+	"LAN Desk",
+	"Ivanti EPM",
+	"IvantiEPM",
+	"Laplink",
+	"Laplink Everywhere",
+	"LaplinkEverywhere",
+	"Level",
+	"Level RMM",
+	"LevelRMM",
+	"LiteManager",
+	"Lite Manager",
+	"LogMeIn",
+	"Log Me In",
+	"LogMeIn Rescue",
+	"LogMeInRescue",
+
+	// M
+	"ManageEngine",
+	"Manage Engine",
+	"ManageEngine RMM",
+	"ManageEngineRMM",
+	"MeshCentral",
+	"Mesh Central",
+	"Mikogo",
+	"mRemoteNG",
+	"mRemote NG",
+
+	// N
+	"N-able",
+	"Nable",
+	"N-able RMM",
+	"NableRMM",
+	"N-Central",
+	"NCentral",
+	"NetOp",
+	"Net Op",
+	"NetSupport",
+	"Net Support",
+	"NetSupport Manager",
+	"NetSupportManager",
+	"NetViewer",
+	"Net Viewer",
+	"Neturo",
+	"NinjaOne",
+	"Ninja One",
+	"NinjaRMM",
+	"Ninja RMM",
+	"NoMachine",
+	"No Machine",
+
+	// O
+	"Oray",
+	"Oray Sunlogin",
+	"OraySunlogin",
+
+	// P
+	"PAExec",
+	"Parallels",
+	"Parallels RAS",
+	"ParallelsRAS",
+	"PCAnywhere",
+	"PC Anywhere",
+	"PCMonitor",
+	"PC Monitor",
+	"PCVisit",
+	"PC Visit",
+	"PDQ Connect",
+	"PDQConnect",
+	"Pilixo",
+	"PocketCloud",
+	"Pocket Cloud",
+	"Pulseway",
+	"PsExec",
+
+	// R
+	"Radmin",
+	"Rapid7",
+	"Rapid7 Insight",
+	"Rapid7Insight",
+	"RealVNC",
+	"Real VNC",
+	"Remote Utilities",
+	"RemoteUtilities",
+	"RemotePC",
+	"Remote PC",
+	"RemoteCall",
+	"Remote Call",
+	"RemoteView",
+	"Remote View",
+	"Remote.It",
+	"RemoteIt",
+	"Remcos",
+	"Remobo",
+	"Rport",
+	"RPort",
+	"RustDesk",
+	"Rust Desk",
+	"RDP",
+	"Remote Desktop",
+	"RemoteDesktop",
+
+	// S
+	"Screenleap",
+	"Screen Leap",
+	"ScreenMeet",
+	"Screen Meet",
+	"Seetrol",
+	"Senso",
+	"ServerEye",
+	"Server Eye",
+	"ShowMyPC",
+	"Show My PC",
+	"SimpleHelp",
+	"Simple Help",
+	"Site24x7",
+	"Site 24x7",
+	"SolarWinds",
+	"Solar Winds",
+	"SolarWinds RMM",
+	"SolarWindsRMM",
+	"SolarWinds Dameware",
+	"SolarWindsDameware",
+	"Sorillus",
+	"Splashtop",
+	"Splash Top",
+	"Splashtop SOS",
+	"SplashtopSOS",
+	"Supremo",
+	"Supremo Remote",
+	"SupremoRemote",
+	"Syncro",
+	"SyncroMSP",
+	"Syncro MSP",
+	"SysAid",
+	"Sys Aid",
+
+	// T
+	"TacticalRMM",
+	"Tactical RMM",
+	"Tailscale",
+	"Tail Scale",
+	"Tanium",
+	"TeamViewer",
+	"Team Viewer",
+	"TightVNC",
+	"Tight VNC",
+	"ToDesk",
+	"To Desk",
+	"TurboMeeting",
+	"Turbo Meeting",
+	"TigerVNC",
+	"Tiger VNC",
+
+	// U
+	"UltraVNC",
+	"Ultra VNC",
+	"UltraViewer",
+	"Ultra Viewer",
+
+	// V
+	"VNC",
+	"VNC Connect",
+	"VNCConnect",
+	"VNC Server",
+	"VNCServer",
+	"VNC Viewer",
+	"VNCViewer",
+
+	// W
+	"Weezo",
+	"WinSCP",
+	"Win SCP",
+
+	// X
+	"Xeox",
+	"Xpra",
+
+	// Z
+	"Zabbix",
+	"ZeroTier",
+	"Zero Tier",
+	"Zoho",
+	"Zoho Assist",
+	"ZohoAssist",
+	"ZOC",
+	"ZOC Terminal",
+	"ZOCTerminal",
+
+	// Additional variants and abbreviations
+	"RMM",
+	"Remote Management",
+	"RemoteManagement",
+	"Remote Monitoring",
+	"RemoteMonitoring",
+	"Remote Support",
+	"RemoteSupport",
+	"Remote Access",
+	"RemoteAccess",
+	"Remote Control",
+	"RemoteControl",
+	"Remote Admin",
+	"RemoteAdmin",
+	"Remote Administrator",
+	"RemoteAdministrator",
+
+	// MSP Tools
+	"MSP360",
+	"MSP 360",
+	"Continuum",
+	"Autotask",
+	"Auto Task",
+	"Kaseya BMS",
+	"KaseyaBMS",
+	"Connectwise Manage",
+	"ConnectwiseManage",
+	"Connectwise Automate",
+	"ConnectwiseAutomate",
+
+	// Cloud-based
+	"AWS Systems Manager",
+	"AWSSystemsManager",
+	"Azure Arc",
+	"AzureArc",
+	"Google Remote Desktop",
+	"GoogleRemoteDesktop",
+
+	// Open Source
+	"Apache Guacamole",
+	"ApacheGuacamole",
+	"Remmina",
+	"FreeRDP",
+	"Free RDP",
+	"xRDP",
+	"OpenSSH",
+	"Open SSH",
+
+	// Additional Commercial
+	"AeroAdmin",
+	"Aero Admin",
+	"Alpemix Service",
+	"AlpemixService",
+	"BeamYourScreen",
+	"Beam Your Screen",
+	"Cloudflared",
+	"Cloudflare Tunnel",
+	"CloudflareTunnel",
+	"CrossTec",
+	"Cross Tec",
+	"CrossTec Remote Control",
+	"CrossTecRemoteControl",
+	"DeskRoll",
+	"Desk Roll",
+	"Electric",
+	"Electric RMM",
+	"ElectricRMM",
+	"Encapto",
+	"EricomConnect",
+	"Ericom Connect",
+	"ESet RMM",
+	"ESetRMM",
+	"ESET Remote Administrator",
+	"ESETRemoteAdministrator",
+	"GetGo",
+	"Get Go",
+	"GoToHTTP",
+	"GoTo HTTP",
+	"Goverreach",
+	"HelpMe",
+	"Help Me",
+	"ImInTouch",
+	"I'm InTouch",
+	"IntelliAdmin",
+	"Intelli Admin",
+	"ITSM",
+	"Manage Engine ITSM",
+	"ManageEngineITSM",
+	"Kabuto",
+	"KHelpDesk",
+	"K Help Desk",
+	"Laplink Gold",
+	"LaplinkGold",
+	"LogicNow",
+	"Logic Now",
+	"MaxFocus",
+	"Max Focus",
+	"MioNet",
+	"Mio Net",
+	"MyGreenPC",
+	"My Green PC",
+	"Naverisk",
+	"Naverisk RMM",
+	"NaveriskRMM",
+	"Netop Remote Control",
+	"NetopRemoteControl",
+	"Neturo",
+	"NTRSupport",
+	"NTR Support",
+	"OCS Inventory",
+	"OCSInventory",
+	"OptiTune",
+	"Opti Tune",
+	"Panorama9",
+	"Panorama 9",
+	"Parsec",
+	"PocketController",
+	"Pocket Controller",
+	"Radmin VPN",
+	"RadminVPN",
+	"Remobo",
+	"RemotePass",
+	"Remote Pass",
+	"RemoteWorkforce",
+	"Remote Workforce",
+	"RepairShopr",
+	"Repair Shopr",
+	"RocketRemoteDesktop",
+	"Rocket Remote Desktop",
+	"RoyalTS",
+	"Royal TS",
+	"RPort",
+	"R Port",
+	"RuDesktop",
+	"Ru Desktop",
+	"Servably",
+	"Simple Gateway",
+	"SimpleGateway",
+	"SmartFTP",
+	"Smart FTP",
+	"SuperOps",
+	"Super Ops",
+	"SuperOps.ai",
+	"SuperOpsAI",
+	"SupportTool",
+	"Support Tool",
+	"SyncThru",
+	"Sync Thru",
+	"SyncTrayzor",
+	"Sync Trayzor",
+	"TeamTaskManager",
+	"Team Task Manager",
+	"TechinLine",
+	"Techin Line",
+	"Total Software Deployment",
+	"TotalSoftwareDeployment",
+	"Webex",
+	"Webex PCNow",
+	"WebexPCNow",
+	"WiseRMM",
+	"Wise RMM",
+	"Xpra",
+	"X Pra",
+	"XSight",
+	"X Sight",
+	"Yandex",
+	"Yandex Remote Desktop",
+	"YandexRemoteDesktop",
+}