Remote Access Tool Install Following Teams Vishing/Email Bombing Chain
Detects the execution of known remote access tools (AnyDesk, TeamViewer, Quick Assist) on Windows systems. The rule is intended to be used in a correlated detection pipeline that identifies a multi-stage attack chain involving an initial email-bombing flood followed by an external Microsoft Teams vishing call impersonating IT support.
Sigma
