AnyDesk and N-able RMM LNK impersonation for persistent remote access
This rule detects multiple indicators associated with the deployment of unauthorized or malicious Remote Monitoring and Management (RMM) tools, specifically focusing on impersonated shortcut files, suspicious command-line execution patterns, registry-based persistence mechanisms, and the presence of configuration files for remote access software like AnyDesk.
Microsoft Sentinel (KQL)
