FBI PSA I-101326-PSA (Oct 13) says no single indicator works; layer weak signals ("identity in depth"). Endpoint signals it lists: remote desktop / RMM tools (AnyDesk, TeamViewer, RustDesk, Chrome Remote Desktop, Splashtop), KVM-over-IP hardware (TinyPilot, PiKVM, GL.iNet), OBS Studio with the VDO.Ninja plugin, Homebrew on non-dev roles, and high churn in bank, address and account details. DOJ's Operation Lonestar Roundup release lists 11 Gmail addresses tied to the scheme for HR and IdP watchlists.

// KQL sketch: stack remote-control tooling per device
DeviceProcessEvents
| where FileName in~ ("AnyDesk.exe","TeamViewer.exe","rustdesk.exe","remoting_host.exe","obs64.exe")
| summarize tools=make_set(FileName) by DeviceName
| where array_length(tools) >= 2
DeviceNetworkEvents
| where RemoteUrl has "vdo.ninja"
DeviceEvents
| where ActionType == "PnpDeviceConnected"
| where AdditionalFields has_any ("PiKVM","TinyPilot")

The FBI warns that aggressive filters cause false positives against legitimate remote staff. Route hits to a joint HR/security review, not auto-action. Validate process names in your environment.