Suspicious RMM Tool Execution via Command Line
This rule detects the use of PowerShell or Command Prompt to execute commands related to Remote Monitoring and Management (RMM) software or remote management tools such as IDrive or TeamViewer. It specifically looks for command-line arguments involving RMM-related keywords combined with execution flags or piping operators, which is a common pattern for automating the deployment, configuration, or malicious use of these remote access tools.
Microsoft Sentinel (KQL)
