Unapproved RMM install/exec from user-writable dirs (AnyDesk, MobaXterm, GRD)

Duo Tech@duotech

•updated Aug 11, 2026•3•0•15

Detects installation or execution of AnyDesk, Google Remote Desktop, or MobaXterm from user-writable directories (Downloads, Temp, AppData) outside the approved software baseline, excluding code-signed installs pushed via Intune/SCCM.