T1219 Remote Access Tools - Suspicious RMM tool child processes
Identifies suspicious child process relationships spawning from known abused RMM tools. Reconstructs the process tree identifying first the RMM tool, a malicious command-line tool child ie. CMD or PowerShell, and subsequently identifies a suspicious child process from this command line tool. Ransomware operators and affiliates follow approaches like this once access is gained via a legitimate remote access tool. Tune and/or add tools as needed; this is far from a complete list.
Microsoft Sentinel (KQL)
