SAFIB

Adversaries are leveraging legitimate Remote Monitoring and Management (RMM) and remote access tools on Windows endpoints for command-and-control, persistence, and execution, with detection focusing on the first observed instance of these tools on a host.

Detects the execution of previously unseen remote monitoring and management (RMM) tools or remote access software on compromised Windows endpoints, often leveraged for command-and-control, persistence, and execution of malicious commands.

This rule detects the first time a remote monitoring and management (RMM) or remote access process is seen on a host within a defined history window, indicating potential command-and-control, persistence, or unauthorized remote access activity.