RMM Installer Masquerading via Browser/Mail Parent + Firewall Rule Add
Detects the installation or execution of common Remote Monitoring and Management (RMM) tools (e.g., ScreenConnect, AnyDesk, Atera) that are initiated from potentially untrusted parent processes like browsers, mail clients, or archive utilities, or that exhibit a code signing discrepancy. The rule further correlates these installation events with subsequent modifications to the Windows firewall within a two-hour window, which is indicative of an adversary establishing remote access persistence.
Microsoft Sentinel (KQL)
