Suspicious RMM Tool Execution from Untrusted Directories
Detects the execution of known Remote Monitoring and Management (RMM) tools from common user-writable or temporary directories (Temp, Downloads, AppData, Public). The rule further filters for processes commonly abused for payload delivery and command execution (powershell.exe, cmd.exe, wscript.exe), or processes containing typical obfuscation and download indicators, excluding benign system process initiators.
Microsoft Sentinel (KQL)
