Chained RMM Tool Installation
Detects when a known Remote Monitoring and Management (RMM) tool is used to install a secondary RMM tool. Threat actors use this technique to establish redundant and persistent access to victim networks.
Microsoft Sentinel (KQL)
