Detection of Gorelo RMM
The rule detects the installation of the Gorelo RMM service by monitoring Windows System events (Event ID 7045) or Security events (Event ID 4697), which record the creation of new services. It specifically looks for service names or binary paths containing the string "gorelo", flagging the moment the agent is first established on the system.
Splunk (SPL)
