Collaboration Application Spawning Remote Access Software
Detects when collaboration applications (like Microsoft Teams or Zoom) or web browsers launch remote support utilities. This activity may indicate social engineering tactics during a screen sharing session, where an attacker convinces a user to install or run remote access software.
Microsoft Sentinel (KQL)
