Browser-Originated Installer Spawns an RMM Client
Detects a browser-downloaded installer spawning ScreenConnect or another remote management client without an established software deployment parent. This rule identifies suspicious process creation where a known installer executable, likely downloaded from a browser (indicated by paths like Downloads, Temp, or AppData), initiates a remote monitoring and management (RMM) tool such as ScreenConnect or ConnectWiseControl. This behavior can indicate an adversary establishing remote access.
Microsoft Sentinel (KQL)
