Multiple VPN Client MSI Installations on a Single Device
This rule detects when two different MSI installations, both related to known VPN clients (Pulse Secure, Fortinet, Ivanti, GlobalProtect), occur on the same device within a short timeframe. This could indicate an attempt to establish redundant access, bypass security controls, or an unusual administrative activity.
Microsoft Sentinel (KQL)
