ROOTBOY RemotePC RMM spawning PowerShell stager to 212.80.7.74
Detects instances where 'RemotePCService.exe' or 'rpccmdhost.exe' (associated with remote access software) spawn 'powershell.exe' with suspicious command-line arguments. These arguments often indicate attempts to execute obfuscated commands, download content from the internet, or execute code in memory, which can be indicative of malicious activity leveraging legitimate remote access tools.
Microsoft Sentinel (KQL)
