Black Basta recon then PowerShell from RMM tool session
Detects host reconnaissance activities (such as whoami or systeminfo) executed via Remote Monitoring and Management (RMM) tools or accompanied by suspicious PowerShell download and execution activity within a specific time window.
Microsoft Sentinel (KQL)
