Remote Management Installer Executed from a User Writable Directory
Detects installation of common remote management products from Downloads, Temp, AppData, Desktop, or Public user paths with silent installation options. This activity is often associated with adversaries establishing persistence or gaining remote access.
Microsoft Sentinel (KQL)
