Remote access software
Named by 2 kept items in this workspace.
Search every workspace for Remote access software. It matches the name as written, so it can find other things that share it.
The items that name it 2
Threat actor abused legitimate remote administration software including MSP360 RMM and ConnectWise ScreenConnect to maintain access.
rogue AnyDesk install with password set
All techniques in this workspace.