rserver3.exe spawning famitrf2.exe post-install execution chain
Detects the execution of 'famitrf2.exe' when it is launched as a child process of 'rserver3.exe' from the specific path 'C:\intel\rserver\rserver3.exe'. This pattern is highly indicative of Remote Administrator (RAdmin) software activity, which can be leveraged for legitimate remote management or malicious remote access.
Microsoft Sentinel (KQL)
