Detection of Pulseway RMM
This rule detects the execution of processes associated with Pulseway RMM (Remote Monitoring and Management) software. It specifically looks for process image file names, original filenames, or parent base filenames containing 'PCMonitorManager.exe' or 'pcmonitorsrv.exe'. These executables are known components of the Pulseway RMM agent. Detection of these processes can indicate the presence of legitimate RMM software, or potentially unauthorized remote access if not sanctioned by the organization.
CQL
