Hunting for Remote Management Tools: Detecting RMMs

This post presents a KQL-based hunting method to identify RMM tools in enterprise environments by searching multiple telemetry fields (filenames, paths, command lines, remote URLs), optimizing performance with has_any on indexed terms, and eliminating duplicate hits via grouping and evidence sets per device. It includes a complete, ready-to-run query and an extensive keyword/domain list mapped to common RMM tools to help distinguish approved from potentially unauthorized RMM usage.