Process Creation of Common RMM Tools
Detects process creation for common RMM tools. The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious. Note: Not using the in(field=ImageFileName, values=["values"]) logic here due to needing regex and variations of the RMM names, and not exact values.
CQL
