SafePay lateral movement: PsExec/WinRM remote execution after RDP or RMM tool us
Detects the correlation of remote execution tools (such as PsExec, WinRM, or specific PowerShell remote execution commands) with RDP or ScreenConnect remote management activity on the same device within a one-hour window, potentially indicating lateral movement or unauthorized remote control.
Microsoft Sentinel (KQL)
