Suspicious Remote Access Tool Deployment
Detects the execution of known remote access tools (e.g., AnyDesk, TeamViewer, RemotePC, IDriveRemotePC) from non-standard parent processes. This helps identify unauthorized or potentially malicious use of remote control software that bypasses standard application deployment or management processes.
Microsoft Sentinel (KQL)
