RMM Network Beacon to Anomalous Ports
Detects continuous command and control (C2) beaconing activity from Remote Monitoring and Management (RMM) tools over non-standard high ports. This rule identifies RMM processes (rmm, agent, client*.exe) establishing frequent network connections to remote IPs on ports greater than 1024, excluding common ports like 3389 (RDP), 8080, and 8443, indicating potential malicious use of RMM software for C2.
Microsoft Sentinel (KQL)
