RMM agent installer (AnyDesk, Bomgar, Zoho Assist, SuperOps) after remote session

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•1

Detects a sequence where a remote-support or screen-share tool (such as Quick Assist or mstsc.exe) is launched followed by the execution of a commercial Remote Monitoring and Management (RMM) agent (such as AnyDesk, Bomgar, Zoho Assist, or SuperOps) on the same device within a 2-hour window. This pattern is commonly associated with vishing and initial access tactics used by threat actors like UNC3753.