Best Detection of 2026 Series – Trojanized RMM Tool Used as Command-and-Control
Detects the execution of known Remote Monitoring and Management (RMM) tool binaries (ScreenConnect, AnyDesk, Atera) that are initiated by suspicious parent processes such as browsers, scripting hosts, or office applications, or run from non-standard locations. This behavior is indicative of threat actors deploying trojanized RMM tools to establish a covert command-and-control channel that blends into normal IT administrative traffic.
Sigma
