Remote Access Installer Downloaded and Executed Within Fifteen Minutes
Correlates a downloaded remote support installer with execution of the same file on the endpoint shortly afterwards. This rule identifies instances where a known remote access tool installer (e.g., AnyDesk, Bomgar, BeyondTrust) is downloaded and then executed on the same device within a 15-minute window, which could indicate an attacker establishing remote access.
Microsoft Sentinel (KQL)
