Unauthorized RMM Tool Execution from Temp/Downloads/AppData
Detects the execution of known Remote Monitoring and Management (RMM) tools from common staging directories (e.g., Temp, Downloads, AppData) or using command-line arguments indicative of a silent or hidden installation, which is a common pattern for initial access and persistence by adversaries.
Sigma
