Unauthorized RMM Activity Detection
This rule detects the use of unauthorized Remote Monitoring and Management (RMM) tools by identifying network connections to RMM-related URLs that have not been observed in a baseline period (last 7 days) but are observed in the last hour. It specifically filters out connections to approved RMM domains and known initiating processes (like web browsers) to reduce false positives. The rule leverages an external list of RMM domains to identify suspicious activity.
Microsoft Sentinel (KQL)
