I ran across this Trend Micro briefing a little while back that might give people some ideas on detection rules for RMM tools. Folks might consider flagging everything that isn't used in their environments.

jsac.jpcert.or.jp/archive/2023...