CMS.exe dropping and launching rs.win32.exe reverse shell from RemoteSetup
Detects the execution or creation of the remote control utility rs.win32.exe from non-standard directories like AppData\Roaming\CMS\RemoteSetup with specific command-line parameters or when launched by CMS.exe.
Microsoft Sentinel (KQL)
