RemotePC Command Execution History
This rule detects suspicious command execution activity originating from RemotePC applications. It identifies instances where 'IDriveRemotePC.exe', 'RemotePC.exe', or 'IDrive.exe' are used to execute commands containing keywords like 'exec', 'execute', 'run', 'invoke', or 'call' at a high frequency (5 or more commands within an hour). This behavior could indicate an adversary using legitimate remote access software for malicious purposes, such as lateral movement or further compromise.
Microsoft Sentinel (KQL)
