SOCLIFE
SOCLIFE

Evidence-led security analysis

Published knowledge

Search SOC//LIFE

DetectionsDET-008

Behavior-based detection engineering

Teams Helpdesk Contact Followed by Quick Assist and Shell

Correlates external support-themed Teams contact with remote-assistance launch and near-immediate shell execution, then exposes WinRM, RMM installation, and Rclone drilldowns.

Behavior

What it detects

An external helpdesk/security-themed Teams contact is followed by remote-assistance software and then cmd.exe or PowerShell for the same identity/device within a short window.

Engineering decision

Why this detection

External Teams messages are common. Quick Assist can be legitimate. PowerShell can be legitimate.

The useful signal is the sequence: an external helpdesk-style Teams contact, a remote-assistance launch for the same identity, and near-immediate shell execution on the endpoint.

The primary detection intentionally stops there. WinRM, RMM installation, trusted application abuse, and Rclone are analyst drilldowns so the rule remains focused on the earliest high-value transition from social engineering into hands-on-keyboard access.

Signal chain

Detection logic

  1. Extract external Teams sender and recipient identity from MessageEvents.
  2. Filter external senders using support/helpdesk/security impersonation terms as a candidate pretext.
  3. Correlate the recipient object ID with remote-assistance process activity.
  4. Require Quick Assist or another remote-support tool to launch within thirty minutes of the Teams contact.
  5. Require cmd.exe or PowerShell activity for the same user/device within five minutes of remote-assistance launch.
  6. Preserve sender, user, device, assist tool, shell, parent, and command-line context.
  7. Use WinRM, RMM installation, and Rclone only as analyst drilldowns rather than primary requirements.

Primary analytic

Query

KQL and SPL express the same analytical intent using source-specific schemas.
Q-01Detection logic

External support-themed Teams contact followed by remote assist and shell

What this checks

Generate a candidate when an external support-themed Teams message is followed by Quick Assist or another remote-support tool and then a shell within minutes for the same user.

KQL
let correlation_window = 30m;
let shell_window = 5m;
let organization_domains = dynamic(["example.com"]);
let support_terms = dynamic([
    "helpdesk",
    "help desk",
    "it support",
    "microsoft support",
    "security",
    "service desk"
]);

let teams =
    MessageEvents
    | where Timestamp >= ago(1d)
    | extend Recipient=parse_json(RecipientDetails)
    | mv-expand Recipient
    | extend
        VictimAccountObjectId=tostring(Recipient.RecipientObjectId),
        VictimRecipientDisplayName=tostring(Recipient.RecipientDisplayName),
        SenderDomain=tolower(extract(@"@([^>]+)$", 1, SenderEmailAddress))
    | where isnotempty(VictimAccountObjectId)
    | where isnotempty(SenderDomain) and SenderDomain !in~ (organization_domains)
    | where SenderDisplayName has_any (support_terms)
    | project
        TeamTime=Timestamp,
        SenderEmailAddress,
        SenderDisplayName,
        SenderDomain,
        VictimRecipientDisplayName,
        VictimAccountObjectId,
        NetworkMessageId;

let remote_assist =
    DeviceProcessEvents
    | where Timestamp >= ago(1d)
    | where FileName in~ ("QuickAssist.exe","AnyDesk.exe","TeamViewer.exe")
    | where isnotempty(AccountObjectId)
    | project
        AssistTime=Timestamp,
        DeviceId,
        DeviceName,
        AccountUpn,
        UserObjectId=AccountObjectId,
        AssistProcess=FileName,
        AssistCommandLine=ProcessCommandLine,
        AssistProcessUniqueId=ProcessUniqueId;

let shells =
    DeviceProcessEvents
    | where Timestamp >= ago(1d)
    | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe")
    | where isnotempty(AccountObjectId)
    | project
        ShellTime=Timestamp,
        DeviceId,
        UserObjectId=AccountObjectId,
        ShellName=FileName,
        ShellCommandLine=ProcessCommandLine,
        ShellParent=InitiatingProcessFileName,
        ShellParentCommandLine=InitiatingProcessCommandLine;

teams
| join kind=inner remote_assist on $left.VictimAccountObjectId == $right.UserObjectId
| where AssistTime between (TeamTime .. TeamTime + correlation_window)
| join kind=inner shells on DeviceId, UserObjectId
| where ShellTime between (AssistTime .. AssistTime + shell_window)
| project
    TeamTime,
    AssistTime,
    ShellTime,
    DeviceName,
    AccountUpn,
    SenderEmailAddress,
    SenderDisplayName,
    SenderDomain,
    AssistProcess,
    AssistCommandLine,
    ShellName,
    ShellCommandLine,
    ShellParent,
    ShellParentCommandLine,
    NetworkMessageId
| order by ShellTime desc
SPL
(
    index=<teams_message_index> sourcetype=<defender_messageevents_sourcetype> earliest=-1d
)
OR
(
    index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-1d
)
| eval
    user_object_id=coalesce(user_object_id,AccountObjectId,RecipientObjectId),
    sender=lower(coalesce(sender,SenderEmailAddress)),
    sender_display=lower(coalesce(sender_display,SenderDisplayName)),
    sender_domain=lower(replace(sender,"^.*@","")),
    device=coalesce(device,DeviceName,host),
    process_name=lower(coalesce(process_name,FileName)),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    parent_process_name=lower(coalesce(parent_process_name,InitiatingProcessFileName)),
    parent_command_line=coalesce(parent_command_line,InitiatingProcessCommandLine),
    event_type=case(
        isnotnull(SenderEmailAddress),"teams",
        process_name IN ("quickassist.exe","anydesk.exe","teamviewer.exe"),"remote_assist",
        process_name IN ("cmd.exe","powershell.exe","pwsh.exe"),"shell",
        true(),"other"
    ),
    external_support=if(
        event_type="teams"
        AND sender_domain!="example.com"
        AND (
            like(sender_display,"%helpdesk%")
            OR like(sender_display,"%help desk%")
            OR like(sender_display,"%it support%")
            OR like(sender_display,"%microsoft support%")
            OR like(sender_display,"%security%")
            OR like(sender_display,"%service desk%")
        ),1,0
    )
| where event_type!="other"
| sort 0 user_object_id _time
| streamstats current=f
    last(eval(if(event_type="teams" AND external_support=1,_time,null()))) as teams_time
    last(eval(if(event_type="teams" AND external_support=1,sender,null()))) as teams_sender
    last(eval(if(event_type="teams" AND external_support=1,sender_display,null()))) as teams_sender_display
    last(eval(if(event_type="remote_assist",_time,null()))) as assist_time
    last(eval(if(event_type="remote_assist",process_name,null()))) as assist_process
    by user_object_id
| where
    event_type="shell"
    AND isnotnull(teams_time)
    AND isnotnull(assist_time)
    AND assist_time>=teams_time
    AND assist_time<=teams_time+1800
    AND _time>=assist_time
    AND _time<=assist_time+300
| table
    _time teams_time assist_time user_object_id device
    teams_sender teams_sender_display assist_process
    process_name process_command_line parent_process_name parent_command_line
| sort - _time

What to look for

A compact collaboration-to-endpoint sequence consistent with Microsoft-documented helpdesk impersonation and hands-on-keyboard access.

Technical details

Tested signal

External collaboration pretext + remote-assistance launch + near-immediate command shell.

Assumptions

  • MessageEvents recipient object IDs can be correlated with DeviceProcessEvents AccountObjectId.
  • The organization's accepted email/tenant domains are configured in the detection.
  • Quick Assist, AnyDesk, and TeamViewer are starting remote-assistance examples and should be adapted to local tooling.

Data requirements and relevant fields

saas audit

Microsoft Defender XDR MessageEvents representing Microsoft Teams collaboration events with sender and recipient identity context.

  • Timestamp
  • SenderEmailAddress
  • SenderDisplayName
  • RecipientDetails
  • NetworkMessageId
  • ThreatTypes
  • DeliveryAction
process

Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.

  • Timestamp
  • DeviceId
  • DeviceName
  • FileName
  • FolderPath
  • ProcessId
  • ProcessUniqueId
  • ProcessCommandLine
  • ProcessVersionInfoOriginalFileName
  • AccountUpn
  • AccountObjectId
  • AccountName
  • SHA1
  • SHA256
  • InitiatingProcessFileName
  • InitiatingProcessCommandLine
  • InitiatingProcessId
  • InitiatingProcessUniqueId
  • InitiatingProcessAccountUpn
  • InitiatingProcessAccountObjectId
KQL schema

Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.

SPL schema

Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.

Limitations

  • Legitimate outsourced support can create a similar sequence.
  • Display-name keywords are a candidate filter, not an identity-verification mechanism.
  • Organizations with approved external support should tune by exact partner tenant/domain, remote-support tool, user population, and ticket context.

The Microsoft article publishes a Teams-to-RMM hunt pattern. This version adds a tight shell-execution requirement to reduce noise and make the candidate more suitable as a production starting point.

Analyst workflow

What the analyst should look for

  • Was the Teams sender external to the organization?
  • Does the sender actually belong to an approved IT/helpdesk partner?
  • Did the user expect the support interaction and can they verify it through a trusted channel?
  • Was Quick Assist or another RMM tool launched immediately after the conversation?
  • Did cmd.exe or PowerShell appear within minutes?
  • What discovery commands were executed first?
  • Did trusted vendor applications execute from unusual paths or with suspicious modules?
  • Did the workstation initiate WinRM toward servers or domain controllers?
  • Was new RMM software installed through msiexec?
  • Did Rclone or another synchronization utility transfer data externally?

Expected result

A compact collaboration-to-endpoint sequence consistent with Microsoft-documented helpdesk impersonation and hands-on-keyboard access.

Investigation pivots

Drilldowns

Use the candidate context to reconstruct what executed, what changed, and what communicated next.
View query — Review Quick Assist anchored reconnaissance
Q-02Drilldown

Review Quick Assist anchored reconnaissance

What this checks

List shell and discovery processes in the first ten minutes after the candidate remote-assistance launch.

KQL
let target_device="<DEVICE_NAME>";
let assist_time=datetime(<ASSIST_TIME_UTC>);
DeviceProcessEvents
| where Timestamp between (assist_time .. assist_time + 10m)
| where DeviceName =~ target_device
| where FileName in~ (
    "cmd.exe","powershell.exe","pwsh.exe","whoami.exe","hostname.exe",
    "ipconfig.exe","systeminfo.exe","nltest.exe","net.exe","net1.exe",
    "quser.exe","query.exe","tasklist.exe","sc.exe"
)
| project Timestamp,DeviceName,AccountUpn,FileName,ProcessCommandLine,FolderPath,SHA1,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp asc
SPL
index=<endpoint_process_index> sourcetype=<process_events_sourcetype>
earliest=<qa_time> latest=<assist_plus_10m>
| eval
    device=coalesce(device,DeviceName,host),
    user=lower(coalesce(user,AccountUpn)),
    process_name=lower(coalesce(process_name,FileName)),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    parent_process_name=lower(coalesce(parent_process_name,InitiatingProcessFileName)),
    parent_command_line=coalesce(parent_command_line,InitiatingProcessCommandLine)
| where device="<DEVICE_NAME>"
    AND process_name IN (
        "cmd.exe","powershell.exe","pwsh.exe","whoami.exe","hostname.exe",
        "ipconfig.exe","systeminfo.exe","nltest.exe","net.exe","net1.exe",
        "quser.exe","query.exe","tasklist.exe","sc.exe"
    )
| fields _time device user process_name process_command_line parent_process_name parent_command_line SHA1 SHA256
| sort 0 _time

What to look for

A hands-on-keyboard burst involving shell, identity, host, network, domain, service, or process discovery.

Technical details

Tested signal

Rapid reconnaissance after remote-assistance start.

Assumptions

  • The candidate device and AssistTime are known from Q-01.

Data requirements and relevant fields

process

Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.

  • Timestamp
  • DeviceId
  • DeviceName
  • FileName
  • FolderPath
  • ProcessId
  • ProcessUniqueId
  • ProcessCommandLine
  • ProcessVersionInfoOriginalFileName
  • AccountUpn
  • AccountObjectId
  • AccountName
  • SHA1
  • SHA256
  • InitiatingProcessFileName
  • InitiatingProcessCommandLine
  • InitiatingProcessId
  • InitiatingProcessUniqueId
  • InitiatingProcessAccountUpn
  • InitiatingProcessAccountObjectId
KQL schema

Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.

SPL schema

Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.

Limitations

  • Legitimate support sessions can include the same utilities.

KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.

View query — Find outbound WinRM from the candidate workstation
Q-03Drilldown

Find outbound WinRM from the candidate workstation

What this checks

Search the candidate device for TCP 5985 activity toward additional internal systems after remote-assistance access.

KQL
let target_device="<DEVICE_NAME>";
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where DeviceName =~ target_device
| where RemotePort == 5985
| project
    Timestamp,
    DeviceId,
    DeviceName,
    LocalIP,
    RemoteIP,
    RemotePort,
    Protocol,
    RemoteUrl,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    InitiatingProcessAccountUpn,
    InitiatingProcessUniqueId
| order by Timestamp asc
SPL
index=<endpoint_network_index> sourcetype=<endpoint_network_events_sourcetype>
earliest=-7d
| eval
    device=coalesce(device,DeviceName,host),
    remote_ip=coalesce(remote_ip,RemoteIP,dest_ip),
    remote_port=coalesce(remote_port,RemotePort,dest_port),
    process_name=lower(coalesce(process_name,InitiatingProcessFileName)),
    process_command_line=coalesce(process_command_line,InitiatingProcessCommandLine),
    user=lower(coalesce(user,InitiatingProcessAccountUpn))
| where device="<DEVICE_NAME>" AND remote_port=5985
| fields _time device user process_name process_command_line remote_ip remote_port Protocol
| sort 0 _time

What to look for

WinRM connections toward servers or identity infrastructure that are not part of the device's normal administration pattern.

Technical details

Tested signal

WinRM lateral movement originating from the compromised device.

Assumptions

  • DeviceNetworkEvents covers the candidate and internal destinations.

Data requirements and relevant fields

network

Microsoft Defender for Endpoint network telemetry with destination, port, protocol, initiating process, device, and user context.

  • Timestamp
  • DeviceId
  • DeviceName
  • RemoteUrl
  • RemoteIP
  • RemotePort
  • Protocol
  • LocalIP
  • LocalPort
  • InitiatingProcessFileName
  • InitiatingProcessCommandLine
  • InitiatingProcessAccountUpn
  • InitiatingProcessAccountObjectId
  • InitiatingProcessUniqueId
KQL schema

Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.

SPL schema

Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.

Limitations

  • WinRM is legitimate from authorized management workstations.

KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.

View query — Find remote-management installation via msiexec
Q-04Drilldown

Find remote-management installation via msiexec

What this checks

Identify Windows Installer launching network- or package-backed MSI installs after the lateral-movement window.

KQL
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("http://","https://",".msi")
| project Timestamp,DeviceName,AccountUpn,FileName,ProcessCommandLine,FolderPath,SHA1,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc
SPL
index=<endpoint_process_index> sourcetype=<process_events_sourcetype>
earliest=-7d
| eval
    process_name=lower(coalesce(process_name,FileName)),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    device=coalesce(device,DeviceName,host),
    user=lower(coalesce(user,AccountUpn))
| where process_name="msiexec.exe"
    AND (
        like(lower(process_command_line),"%http://%")
        OR like(lower(process_command_line),"%https://%")
        OR like(lower(process_command_line),"%.msi%")
    )
| fields _time device user process_name process_command_line SHA1 SHA256 InitiatingProcessFileName InitiatingProcessCommandLine
| sort - _time

What to look for

Unexpected MSI installation on compromised/laterally accessed hosts, especially from network or web locations.

Technical details

Tested signal

msiexec command lines consistent with remote-management tooling installation.

Assumptions

  • The candidate devices and intrusion timeframe are known.

Data requirements and relevant fields

process

Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.

  • Timestamp
  • DeviceId
  • DeviceName
  • FileName
  • FolderPath
  • ProcessId
  • ProcessUniqueId
  • ProcessCommandLine
  • ProcessVersionInfoOriginalFileName
  • AccountUpn
  • AccountObjectId
  • AccountName
  • SHA1
  • SHA256
  • InitiatingProcessFileName
  • InitiatingProcessCommandLine
  • InitiatingProcessId
  • InitiatingProcessUniqueId
  • InitiatingProcessAccountUpn
  • InitiatingProcessAccountObjectId
KQL schema

Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.

SPL schema

Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.

Limitations

  • Enterprise software deployment frequently uses msiexec and must be baselined by deployment platform.

KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.

View query — Check Rclone data-transfer behavior
Q-05Drilldown

Check Rclone data-transfer behavior

What this checks

Find rclone.exe and prioritize command lines resembling Microsoft's source-reported cloud-exfiltration pattern.

KQL
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "rclone.exe" or ProcessVersionInfoOriginalFileName =~ "rclone.exe"
| extend SourceReportedPattern =
    ProcessCommandLine has "copy "
    and ProcessCommandLine has "--config"
    and ProcessCommandLine has "--transfers"
    and ProcessCommandLine has "--checkers"
    and ProcessCommandLine has "--buffer-size"
| project Timestamp,DeviceName,AccountUpn,FileName,ProcessVersionInfoOriginalFileName,FolderPath,ProcessCommandLine,SourceReportedPattern,SHA1,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc
SPL
index=<endpoint_process_index> sourcetype=<process_events_sourcetype>
earliest=-7d
| eval
    process_name=lower(coalesce(process_name,FileName)),
    original_name=lower(coalesce(original_name,ProcessVersionInfoOriginalFileName)),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    device=coalesce(device,DeviceName,host),
    user=lower(coalesce(user,AccountUpn))
| where process_name="rclone.exe" OR original_name="rclone.exe"
| eval source_reported_pattern=if(
    like(lower(process_command_line),"%copy %")
    AND like(lower(process_command_line),"%--config%")
    AND like(lower(process_command_line),"%--transfers%")
    AND like(lower(process_command_line),"%--checkers%")
    AND like(lower(process_command_line),"%--buffer-size%"),
    1,0
)
| fields _time device user process_name original_name process_command_line source_reported_pattern SHA1 SHA256 InitiatingProcessFileName InitiatingProcessCommandLine
| sort - _time

What to look for

Rclone process execution inconsistent with approved backup/synchronization workflows.

Technical details

Tested signal

Rclone copy activity with explicit config and parallel-transfer arguments.

Assumptions

  • Process telemetry covers the late-stage intrusion window.

Data requirements and relevant fields

process

Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.

  • Timestamp
  • DeviceId
  • DeviceName
  • FileName
  • FolderPath
  • ProcessId
  • ProcessUniqueId
  • ProcessCommandLine
  • ProcessVersionInfoOriginalFileName
  • AccountUpn
  • AccountObjectId
  • AccountName
  • SHA1
  • SHA256
  • InitiatingProcessFileName
  • InitiatingProcessCommandLine
  • InitiatingProcessId
  • InitiatingProcessUniqueId
  • InitiatingProcessAccountUpn
  • InitiatingProcessAccountObjectId
KQL schema

Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.

SPL schema

Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.

Limitations

  • Rclone is legitimate for backup, migration, and administration in some organizations.

KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.

Legitimate resemblance

What the analyst should confirm

Similar activity can be legitimate. Confirm the approved purpose and expected context before escalating.

  • An approved external IT provider contacts a user in Teams, launches Quick Assist, and opens PowerShell for legitimate troubleshooting.

    The sender domain/tenant is approved, a support ticket exists, the user confirms the session, the engineer identity matches the provider, and commands/destinations align with documented support activity.

  • Internal IT uses Quick Assist after a Teams conversation but the sender is represented through an external service address.

    The sender maps to a known support integration, device/user are in the approved support population, and no lateral movement, unknown payload, RMM install, or exfiltration follows.

  • A managed software-deployment platform runs msiexec and legitimate RMM on hosts also used by support staff.

    The parent process, deployment service account, package signer/hash, management server, target population, and change window all match the approved deployment.

Confirmed match

Action after a confirmed match

  • Isolate the endpoint and stop unauthorized remote sessions.
  • Block or remove attacker-deployed RMM, payloads, side-loaded modules, and persistence.
  • Reset/revoke credentials used during the session and lateral movement.
  • Scope all WinRM destination hosts and contain affected systems.
  • Block confirmed malicious C2 and exfiltration destinations.
  • Investigate Rclone source paths, remote destinations, and transferred data.
  • Restrict WinRM and remote-support tooling to approved management paths.
  • Review Teams external-collaboration policy and helpdesk verification procedures.

Threat hunt

Could this be happening elsewhere?

Hunt for this behavior across the environment.
View threat hunt

Technical boundary

Telemetry and limitations

Saas Audit

Microsoft Defender XDR MessageEvents representing Microsoft Teams collaboration events with sender and recipient identity context.

Required fields
  • Timestamp
  • SenderEmailAddress
  • SenderDisplayName
  • RecipientDetails
  • NetworkMessageId
  • ThreatTypes
  • DeliveryAction
Process

Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.

Required fields
  • Timestamp
  • DeviceId
  • DeviceName
  • FileName
  • FolderPath
  • ProcessId
  • ProcessUniqueId
  • ProcessCommandLine
  • ProcessVersionInfoOriginalFileName
  • AccountUpn
  • AccountObjectId
  • AccountName
  • SHA1
  • SHA256
  • InitiatingProcessFileName
  • InitiatingProcessCommandLine
  • InitiatingProcessId
  • InitiatingProcessUniqueId
  • InitiatingProcessAccountUpn
  • InitiatingProcessAccountObjectId
Network

Microsoft Defender for Endpoint network telemetry with destination, port, protocol, initiating process, device, and user context.

Required fields
  • Timestamp
  • DeviceId
  • DeviceName
  • RemoteUrl
  • RemoteIP
  • RemotePort
  • Protocol
  • LocalIP
  • LocalPort
  • InitiatingProcessFileName
  • InitiatingProcessCommandLine
  • InitiatingProcessAccountUpn
  • InitiatingProcessAccountObjectId
  • InitiatingProcessUniqueId

Blind spots

  • Organizations without Defender for Office 365 Teams message telemetry cannot perform direct collaboration-to-endpoint correlation.
  • A sophisticated impersonator can avoid support-related display-name keywords, so the primary filter needs local adaptation and complementary Teams detections.
  • Quick Assist can be replaced with other remote tools, including approved enterprise software.
  • Shell execution might occur in a different user/session context and weaken direct object-ID correlation.
  • WinRM can be encrypted or proxied while endpoint connection telemetry still shows only destination/port and process context.
  • Rclone can be renamed; OriginalFileName helps where populated but is not guaranteed.

Behavior mapping

MITRE ATT&CK

Mappings describe the behavior examined by this analytic. They do not prove attribution, deployment, or technique-wide coverage.

Review boundary

Sources and limits

External sources
3

Exact fields, retention, and operational thresholds remain environment-specific.

Page navigation

Sections