External Teams help desk contact followed by Quick Assist session on same user
Correlates external Microsoft Teams chat, impersonation, or security risk events targeting a user with the subsequent launch of the Quick Assist application on that user's device within a short timeframe, indicating potential social engineering or tech support scams.
Microsoft Sentinel (KQL)
