Remote Access Tool Install (AnyDesk/TeamViewer/ScreenConnect)
Detects the installation or service setup of unauthorized remote access tools (such as AnyDesk, TeamViewer, or ScreenConnect) followed by outbound public network connections from the same device within a one-hour window.
Microsoft Sentinel (KQL)
