T1219: Quick Assist Launched Shortly After Teams Activity (Helpdesk Vishing)
Detects the execution of known remote monitoring and management (RMM) or remote access tools shortly after Microsoft Teams process activity on a host. This behavior is consistent with helpdesk-impersonation vishing attacks where an adversary convinces a user to initiate a remote session.
Microsoft Sentinel (KQL)
