Remote monitoring and management tool abuse
Named by 2 kept items in this workspace.
Search every workspace for Remote monitoring and management tool abuse. It matches the name as written, so it can find other things that share it.
The items that name it 2
AnyDesk installed and used as a C2/remote access channel to deploy further tooling
A renamed copy of GotoHTTP was dropped on the endpoint for remote access in Incident 1.
All techniques in this workspace.