RMM Tool Usage Summary warnign query is heavy as F***
This rule identifies and summarizes the usage of various Remote Monitoring and Management (RMM) tools across an environment. It correlates process execution events (based on executable and process names) and network connection events (based on remote URLs/domains) with a predefined list of known RMM tools. The output provides a count of unique devices using each RMM tool, grouped by machine group, allowing for an overview of RMM tool prevalence and distribution.
Microsoft Sentinel (KQL)
