Remote Access Tool - Ammy Admin Agent Execution via rundll32

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•19

Detects the execution of the Ammyy Admin RMM agent for remote management, specifically when rundll32.exe is used to load and execute the aa_nts.dll component.