TA4922 RMM Staging After Business Lure
This rule detects the staging of remote management tools (AnyDesk, RustDesk, ScreenConnect, TeamViewer) on a device, where the initiating process's command line contains keywords related to business lures (invoice, payroll, tax, HR, resume, quotation). This pattern is indicative of TA4922 activity, where attackers use business-themed social engineering to gain initial access and then deploy RMM tools for persistent access before deploying ransomware.
Microsoft Sentinel (KQL)
