Detection of Netbird RMM
This rule detects the execution of processes related to 'Netbird', a peer-to-peer VPN solution that can also be used for remote access and management. It specifically looks for 'netbird' in the image file name, original file name, or parent base file name of a process on Windows platforms. Detection of this activity could indicate the legitimate use of Netbird for remote access or, in a malicious context, the deployment of a remote monitoring and management (RMM) tool by an adversary.
CQL
