WinSCP or Rclone (incl. renamed) exfiltration to external IPs after RMM tool
Detects potential data exfiltration activity where a device first exhibits usage of a remote monitoring and management (RMM) tool, followed by the execution of known data transfer or exfiltration utilities such as WinSCP or Rclone.
Microsoft Sentinel (KQL)
