AgtaBackupAgent.msi silent install via PowerShell spawned by RMM agent
Detects PowerShell and msiexec activity referencing AgtaBackupAgent.msi where the parent process or initiator is associated with known Remote Monitoring and Management (RMM) tools such as LogMeIn Resolve, ConnectWise ScreenConnect, Ops RMM, or TraceRMM.
Microsoft Sentinel (KQL)
