Remote Assistance Tool Execution on Host with Microsoft Teams
This rule detects the execution of QuickAssist.exe or RemSupp.exe on a host where Microsoft Teams has also been executed within the last day. This pattern may indicate the use of built-in remote support tools in conjunction with communication platforms, potentially for unauthorized remote access or suspicious remote assistance activities.
Microsoft Sentinel (KQL)
