Remote Monitoring and Management (RMM) Tool Distributed via Microsoft Teams
This detection identifies when a Microsoft Teams message containing a URL associated with a known Remote Monitoring and Management (RMM) tool was sent and subsequently clicked by the intended recipient or the original sender. The domain is not part of the organization's approved RMM solutions, indicating a potential use of Living-off-the-Land RMM (LOLRMM) techniques often employed in initial access or persistence stages by threat actors. This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
Microsoft Sentinel (KQL)
