Remote access tools (AnyDesk, Plink, ManageEngine UEMS) spawned from Qlik Sense

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•2•0•4

Detects Qlik Sense service processes (scheduler, engine, proxy, repository) spawning or dropping remote access tools such as AnyDesk or Plink, a behavior observed in CACTUS ransomware campaigns.