Remote-access tool launch shortly after external Teams chat (Black Basta)

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•8

Detects correlation between an external Microsoft Teams chat creation and the subsequent launch of a remote access or monitoring (RMM) tool on the same user's device within a 30-minute window, which is indicative of potential social engineering or tech support scam initial access campaigns.