Detection of Remote Monitoring and Management (RMM) Tool Activity
This rule detects the execution of known Remote Monitoring and Management (RMM) tool processes or network connections to domains associated with RMM tools. It leverages an external CSV file containing a list of RMM tool executable names and their associated domains to identify suspicious activity. The rule aims to identify the presence and use of legitimate RMM software, which can be abused by adversaries for remote access and control.
Microsoft Sentinel (KQL)
