Technical summary: This detection rule flags first-time appearances of known remote-management tool (RMM) signers on Windows endpoints by monitoring process start events for processes whose code-signature subject_name matches a curated vendor list. It uses Elastic Defend data and the new_terms pattern to detect novelty within a 10-day history window, alerting when a signer appears environment-wide for the first time. The rule targets Windows hosts, focusing on process start events with a signer in the list; novelty is keyed on the signer string, so multiple binaries signed by the same signer trigger a single alert. MITRE ATT&CK mapping: T1219 (Remote Access Tools) with T1219.002 (Remote Desktop Software), under TA0011 (Command and Control). The investigation fields guide analysts through contextual checks (parent/child processes, file hashes, and network activity) within a 24-hour window to determine if the signer corresponds to legitimate rollout or indicates malicious remote-access activity. The rule is intended for Elastic Defend integration and will report a signer once per fleet within the history window; renaming binaries doesn't generate re-alerts for the same signer within that window. The provided remediation guidance emphasizes evidence preservation, scope refinement by signer/hash, and containment if confirmed malicious, with escalation to responsible incident teams as needed.