RMM MSI install from meeting-themed lure download or ScreenConnect/LogMeIn msiexec
Detects potential malicious software installation via two branches: Branch A identifies MSI files downloaded from suspicious URLs or with meeting/update lures (e.g., Zoom, Google Meet) followed by msiexec installation within one hour. Branch B detects msiexec command lines referencing RMM tools (ScreenConnect, LogMeIn, GoToResolve) combined with paths like Downloads, Temp, or AppData.
Microsoft Sentinel (KQL)
