PowerShell script downloads and installs RMM tool for persistence

Ibrahim Saud@tektrix

•updated 22 days ago•3•0•6

This rule detects the use of PowerShell to download common Remote Monitoring and Management (RMM) or remote access tools from the internet. This behavior is frequently associated with malicious actors attempting to establish persistent remote access to a compromised system.