RMM Tool Usage by Service Account
This rule detects the execution of Remote Monitoring and Management (RMM) tools by service accounts. RMM tools are legitimate software used for IT administration, but their use by service accounts can be indicative of malicious activity, such as an adversary maintaining persistence or performing lateral movement using compromised credentials. The rule identifies processes whose filenames match a predefined list of RMM tool executables or process names and are executed by accounts identified as service accounts based on common naming patterns.
Microsoft Sentinel (KQL)
