Process Creation of Common RMM Tools
Detects process creation for common RMM tools. The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious/malicious.
Microsoft Sentinel (KQL)
