ManageEngine RMM Software Abuse Sequence
Detects a sequence of events where ManageEngine or IDrive remote monitoring software is followed within 120 minutes by the execution of potential staging or encryption-related tools (servertool.exe or encrypt.exe) on the same device. This pattern may indicate the abuse of legitimate administrative tools for unauthorized activities or ransomware-like behavior.
Microsoft Sentinel (KQL)
