Payouts King: Quick Assist Remote Session Initiated via Microsoft Teams
Detects the execution of Microsoft Quick Assist (or related Remote Desktop clients) shortly after activity from Microsoft Teams. This pattern is consistent with social engineering tactics where an attacker impersonates IT personnel over a Teams call to persuade a victim to provide remote access to their workstation.
Microsoft Sentinel (KQL)
