Remote-control software running concurrently with video conferencing app
Detects the execution of known remote-access or screen-sharing software (e.g., TeamViewer, AnyDesk, RDP) within 30 minutes of launching common video conferencing applications (e.g., Zoom, Teams, Google Meet). This pattern is consistent with an adversary remotely assisting an unauthorized user during a live coding interview or similar assessment process.
Microsoft Sentinel (KQL)
