Unauthorized RMM Tool Execution - Quick Assist, AnyDesk, or SyncFuture via Suspicious Parent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•6•0•13

Detects the execution of known Remote Monitoring and Management (RMM) tools (AnyDesk, SyncFuture, QuickAssist, etc.) when launched by suspicious or untrusted parent processes. Additionally monitors for non-standard installation paths for AnyDesk and the creation of persistence registry keys for these RMM tools.