Proof of concept exploit for ManagedITSync (Kaseya & ConnectWise integration)

This repository contains a script created by Truesec CSIRT team which can be used to identify signs of compromise and to some extent, mitigate further risk to a Kaseya monitored endpoint.

Using Powershell to send an ENTER keystroke to the Kaseya prompt window

PowerShell wrapper for the MyITProcess API

Toggle between enabling and disabling the Kaseya Remote Control

Simple KQL query that can be run either in MD for Endpoint (Threat hunting or Custom indicator) or in Azure Sentinel (Threat hunting or analytics rule).It's looking for 4 known IOCs related to the Kaseya attack

This PowerShell module acts as a wrapper for the IT Glue API.

WORK IN PROGRESS: Python bindings/functions to interact with Kaseya VSA's REST API

SDK para KASEYA SOAP