Remote administration tool settings

Detects remote administration tool settings: RDP connection files, TeamViewer/AnyDesk configuration, sshd directives and populated gateway/jump-host/access-password fields. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a remote-tool configuration line (RDP file keys, TeamViewer/AnyDesk ID, AnyDesk password hash, sshd directives) or a populated access field (host, gateway, jump host/bastion, port, access password, allowed users/IPs, session recording)), and 85 needs two distinct structures plus independent remote-access-control (unattended access, MFA, allowlist, vendor access) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth), Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:remote\s+(?:administration|access|support|management)\s+(?:tool|software|configuration|settings|policy)|RDP\s+(?:settings|configuration|file|connection\s+file)|VNC\s+(?:settings|configuration)|(?:TeamViewer|AnyDesk|ScreenConnect|Splashtop|BeyondTrust|Bomgar|RustDesk|LogMeIn)\s+(?:settings|configuration|deployment|policy|console))\b

Corroborative evidence keywords

unattended access, MFA, allowlist, firewall rule, third-party support, vendor access, session timeout, clipboard, file transfer, privileged

Proximity: 300 characters

Should match

Remote access tool settings are managed by the service desk. — Discovery probe (65)
RDP connection file for the finance jump host full address:s:jump01.harbour.internal:3389 — Medium-tier probe (75) - one RDP configuration line
RDP connection file - vendor support full address:s:jump01.harbour.internal:3389 username:s:HARBOUR\svc_vendor gatewayhostname:s:rdgw.harbour.com.au Allowed IPs: 203.0.113.0/24 Unattended access enabled for third-party support; MFA not enforced on the gateway. — High-tier probe (85) - several config lines, access field and control context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: remote access tools must be approved by ICT Security and use MFA. — Policy text
Remote access configuration template Gateway: ________ Access password: [insert] — Blank template
Course module 7: RDP file settings such as full address:s:server01:3389 explained. — Training framing

Known false positives

Vendor knowledge-base articles show RDP and sshd settings. Mitigation: Guidance/training framing is excluded; 85 needs two config lines plus populated access fields.