Product
This rule detects the first time a remote monitoring and management (RMM) or remote access process is seen on a host within a defined history window, indicating potential command-and-control, persistence, or unauthorized remote access activity.