Unauthorized RMM Tool Network Connection via PowerShell or CMD
This rule detects network connections to known Remote Monitoring and Management (RMM) tool domains initiated by `cmd.exe` or `powershell.exe`. This behavior can indicate the unauthorized use of RMM tools by an adversary to gain remote access and control over a compromised system. The rule specifically looks for successful network connections where the remote URL matches a URI from a curated list of RMM domains, and the initiating process is either `cmd.exe` or `powershell.exe`, excluding a specific bypass command line.
Microsoft Sentinel (KQL)
