Payouts King / BlackBasta-Lineage Unauthorized Remote Access Tool Deployment
Detects the execution of known remote access software (e.g., AnyDesk, TeamViewer, Rclone, ScreenConnect) from non-standard file paths or when launched by suspicious parent processes such as cmd.exe, powershell.exe, or script interpreters. This behavior is indicative of potential adversary usage of living-off-the-land techniques or lateral movement via third-party remote access utilities.
Cortex XDR
