RMM tool launch shortly after Microsoft Teams activity (STAC4749 fake IT support
Detects the execution of known Remote Monitoring and Management (RMM) tools within a 30-minute window following Microsoft Teams network activity on the same device, which can be an indicator of unauthorized remote access or interactive command and control setup via remote support applications.
Microsoft Sentinel (KQL)
