Payouts King Unauthorized RMM Tool Execution - AnyDesk/TeamViewer/ScreenConnect
This rule detects the execution and network activity of known Remote Monitoring and Management (RMM) tools such as AnyDesk, TeamViewer, and ScreenConnect. It assigns a risk score based on whether the activity occurs outside of defined business hours (8 AM - 6 PM) and whether the tool is initiating an outbound connection on port 443, a common pattern for C2 communication.
Microsoft Sentinel (KQL)
