AnyDesk Execution Shortly After Microsoft Teams Call (Vishing)

Ibrahim Saud@tektrix

•updated 15 days ago•0•0•3

This rule detects the execution of AnyDesk within a 30-minute window of Microsoft Teams activity on the same device. This pattern is indicative of a vishing attack, where a malicious actor lures a victim into installing remote access software during a fake technical support session initiated via Teams.