RMM tool launch after Teams IT-support impersonation or email bombing
Detects the execution of unauthorized Remote Monitoring and Management (RMM) tools shortly after either Microsoft Teams activity or a surge of inbound emails (email bombing) targeting the same user, a common precursor pattern used by threat actors for social engineering and initial access.
Microsoft Sentinel (KQL)
