Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server (2db93a3f-3249-4f73-9e68-0e77a0f8ae7e)
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line. These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID. This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.