STAC4749 Rapid Vishing-to-Encryption Timeline Correlation
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Microsoft Sentinel (KQL)
