drop rmm remote session export · detect off-hours shell bursts · runs locally
drop rmm remote session export · local only
heuristic screener · vendor schema varies · not definitive proof