Microsoft Teams has become one of the primary collaboration platforms for modern organizations, making it an increasingly attractive target for threat actors. Rather than relying solely on traditional phishing emails, attackers now frequently initiate conversations through Teams by impersonating IT support personnel, trusted partners, or business contacts. These interactions are often designed to establish trust before convincing a victim to install or launch a Remote Management and Monitoring (RMM) tool, providing the attacker with persistent remote access to the endpoint.

While RMM software is widely used by IT administrators for legitimate remote support and device management, many threat actors abuse the same tools because they blend seamlessly into enterprise environments and often bypass traditional malware detections

This analytics rule detects suspicious sequences where a user communicates with an unfamiliar external organization through Microsoft Teams and subsequently executes or uses an RMM application within a defined time window. Rather than alerting on every instance of Teams communication or RMM usage individually, the rule correlates both events to identify behaviors commonly associated with social engineering attacks and unauthorized remote access

Why Teams-Based Social Engineering Is a Growing Threat

Remote support scams have evolved beyond traditional phishing emails containing malicious links or attachments.

Attackers can now contact users directly through collaboration platforms, where conversations may appear more immediate and personal. A direct Teams message can create the impression that the sender is a legitimate employee, technician, vendor, or support provider

A typical attack may involve:

An external user initiating a Teams conversation while impersonating internal IT support
The attacker claiming that the user’s device requires urgent troubleshooting
The user being directed to download or launch a legitimate RMM application
The attacker establishing a remote session on the endpoint
Additional malware deployment, credential theft, persistence, or lateral movement following access

Because Microsoft Teams and commercial RMM products are both legitimate business tools, neither activity is inherently malicious

The risk becomes clearer when the events occur in close succession, particularly when the initial conversation involves an unfamiliar external organization

This detection therefore focuses on the behavioral sequence rather than treating Teams communication or RMM usage as isolated indicators

Detection Strategy

This rule uses a multi-stage behavioral correlation approach to identify potential social engineering attacks involving Microsoft Teams and Remote Management software

The detection performs the following actions:

Builds a baseline of external organizations previously contacted through Microsoft Teams
Identifies recent communications with unfamiliar external domains
Collects RMM-related activity across endpoint telemetry
Normalizes user identities across Microsoft 365 and Defender XDR
Correlates Teams communication with subsequent RMM activity performed by the same user
Generates an alert when RMM activity occurs within four hours of the initial Teams interaction

By combining collaboration telemetry with endpoint activity, the rule detects suspicious attack chains that would likely be missed if each event were analyzed independently

Reference KQL

let FamiliarDomains =
    OfficeActivity
    | where TimeGenerated between (ago(14d) .. ago(1d))
    | where OfficeWorkload == "MicrosoftTeams"
    | where Operation in ("ChatCreated", "TeamsSessionStarted", "MessageSent", "MessageCreatedHasLink", "CallParticipantDetail", "MeetingParticipantDetail", "MeetingDetail")
    | extend Domain = tostring(split(UserId, "@", 1).[0])
    | where isnotempty(Domain)
    | distinct Domain;

let RMMSoftware = externaldata(RMMSoftware: string)[@"https://raw.githubusercontent.com/0x706972686f/RMM-Catalogue/refs/heads/main/rmm.csv"] with (format="csv", ignoreFirstRecord=True);

let ExternalTeamsCommunication =
    OfficeActivity
    | where TimeGenerated >= ago(1d)
    | where OfficeWorkload == "MicrosoftTeams"
    | where Operation in ("ChatCreated", "CallParticipantDetail")
    | extend UserDomain = tostring(split(UserId, "@", 1).[0])
    | where isnotempty(UserDomain)
    | where UserDomain !in (FamiliarDomains)
    | extend OperationDescription = case(
                                        Operation == "ChatCreated",
                                        "A new chat was created in Teams",
                                        Operation == "CallParticipantDetail",
                                        "Call participant details were logged",
                                        "Unknown Operation"
                                    )
    | mv-expand Member = todynamic(Members)
    | extend TargetUPN1 = tostring(Member.UPN)
    | extend TargetDomain1 = tostring(split(TargetUPN1, "@", 1)[0])
    | mv-expand Attendees
    | extend TargetUPN2 = tostring(Attendees.UPN)
    | extend TargetDomain2 = tostring(split(TargetUPN2, "@", 1)[0])
    | extend TargetUPN = coalesce(TargetUPN1, TargetUPN2)
    | extend TargetDomain = coalesce(TargetDomain1, TargetDomain2)
    | project
        TimeGenerated,
        Operation,
        OperationDescription,
        ClientIP,
        UserId,
        UserDomain,
        TargetUPN,
        TargetDomain,
        ChatThreadId
    | extend
        TargetUPN = tolower(TargetUPN),
        TargetDomain = tolower(TargetDomain),
        UserId = tolower(UserId),
        UserDomain = tolower(UserDomain)
    | where TargetUPN != UserId
    | summarize
        StartTimeTeams = min(TimeGenerated),
        Operations = make_set(Operation),
        OperationsDescription = make_set(OperationDescription),
        ClientIPs = make_set_if(ClientIP, isnotempty(ClientIP)),
        ChatThreadIDs = make_set(ChatThreadId)
        by UserId, UserDomain, TargetUPN, TargetDomain
    | join kind=leftouter (
        IdentityInfo
        | where TimeGenerated > ago(14d)
        | summarize arg_max(TimeGenerated, *) by AccountUPN
        | project
            TargetUPN = tolower(AccountUPN),
            TargetAccountDisplayName = tolower(AccountDisplayName),
            TargetAccountName = tolower(AccountName),
            TargetSAMAccountName = tolower(SAMAccountName))
        on TargetUPN
    | project-away TargetUPN1
    | project
        StartTimeTeams,
        Operations,
        OperationsDescription,
        ClientIPs,
        ChatThreadIDs,
        UserId,
        UserDomain,
        TargetUPN,
        TargetDomain,
        TargetAccountDisplayName,
        TargetAccountName,
        TargetSAMAccountName;

let RMMUsage =
    union
        (DeviceNetworkEvents
        | where TimeGenerated > ago(1h)
        | where ActionType == "ConnectionSuccess"
        | where InitiatingProcessFileName has_any (RMMSoftware) or InitiatingProcessParentFileName has_any (RMMSoftware)
        | extend
            InitiatingProcessAccountName = tolower(InitiatingProcessAccountName),
            InitiatingProcessAccountUpn = tolower(InitiatingProcessAccountUpn),
            RMMUsageTime = TimeGenerated
        | project
            RMMUsageTime,
            Type,
            ActionType,
            DeviceName,
            DeviceId,
            InitiatingProcessAccountName,
            InitiatingProcessAccountUpn,
            InitiatingProcessFileName,
            InitiatingProcessParentFileName,
            RemoteUrl,
            RemoteIP),
        (DeviceFileEvents
        | where TimeGenerated > ago(1h)
        | where ActionType == "FileCreated"
        | where FileName has_any (RMMSoftware)
        | extend
            InitiatingProcessAccountName = tolower(InitiatingProcessAccountName),
            InitiatingProcessAccountUpn = tolower(InitiatingProcessAccountUpn),
            RMMUsageTime = TimeGenerated
        | project
            RMMUsageTime,
            Type,
            ActionType,
            DeviceName,
            DeviceId,
            InitiatingProcessAccountName,
            InitiatingProcessAccountUpn,
            FileName,
            FolderPath,
            InitiatingProcessFileName,
            InitiatingProcessFolderPath,
            InitiatingProcessParentFileName),
        (DeviceProcessEvents
        | where TimeGenerated > ago(1h)
        | where ActionType == "ProcessCreated"
        | where FileName has_any (RMMSoftware)
            or InitiatingProcessFileName has_any (RMMSoftware)
            or InitiatingProcessParentFileName has_any (RMMSoftware)
        | extend
            InitiatingProcessAccountName = tolower(InitiatingProcessAccountName),
            InitiatingProcessAccountUpn = tolower(InitiatingProcessAccountUpn),
            AccountName = tolower(AccountName),
            RMMUsageTime = TimeGenerated
        | project
            RMMUsageTime,
            Type,
            ActionType,
            DeviceName,
            DeviceId,
            AccountName,
            InitiatingProcessAccountName,
            AccountUpn,
            InitiatingProcessAccountUpn,
            FileName,
            FolderPath,
            InitiatingProcessFileName,
            InitiatingProcessFolderPath,
            InitiatingProcessParentFileName,
            ProcessCommandLine,
            InitiatingProcessCommandLine)
    | join kind=leftouter (DeviceInfo
        | where TimeGenerated > ago(14d)
        | extend LoggedOnUser = tolower(tostring(parse_json(LoggedOnUsers).[0].UserName))
        | where isnotempty(LoggedOnUser)
        | summarize arg_max(TimeGenerated, *) by DeviceId, LoggedOnUser
        | project DeviceId, LoggedOnUser)
        on DeviceId
    | project-away DeviceId1
    | extend AccountJoin = coalesce(InitiatingProcessAccountUpn, AccountUpn, AccountName, InitiatingProcessAccountName, LoggedOnUser)
    | extend RMMUsed = case(
                           isnotempty(FileName) and FileName has_any (RMMSoftware),
                           FileName,
                           isnotempty(InitiatingProcessFileName) and InitiatingProcessFileName has_any (RMMSoftware),
                           InitiatingProcessFileName,
                           isnotempty(InitiatingProcessParentFileName) and InitiatingProcessParentFileName has_any (RMMSoftware),
                           InitiatingProcessParentFileName,
                           "Unknown"
                       )
    | project-reorder
        RMMUsageTime,
        RMMUsed,
        Type,
        ActionType,
        DeviceName,
        DeviceId,
        AccountJoin,
        AccountName,
        AccountUpn,
        InitiatingProcessAccountName,
        InitiatingProcessAccountUpn,
        LoggedOnUser,
        FileName,
        FolderPath,
        InitiatingProcessFileName,
        InitiatingProcessFolderPath,
        InitiatingProcessParentFileName;

let JoinFunc =
    ExternalTeamsCommunication
    | extend JoinKeys = pack_array(
                            TargetUPN,
                            TargetSAMAccountName,
                            TargetAccountName,
                            TargetAccountDisplayName
                        )
    | mv-expand JoinKey = JoinKeys
    | extend JoinKey = tostring(JoinKey)
    | where isnotempty(JoinKey);

JoinFunc
| join kind=inner (
    RMMUsage
    )
    on $left.JoinKey == $right.AccountJoin
| project-away JoinKey, JoinKeys
| where RMMUsageTime > StartTimeTeams
| where datetime_diff('minute', RMMUsageTime, StartTimeTeams) < 240

Rule Logic Summary

Establishing a Baseline of Familiar Teams Domains

The first stage of the detection establishes what constitutes normal external communication for the organization.

The rule reviews fourteen days of Microsoft Teams activity and extracts the domains associated with previous external communications. These domains form a baseline of organizations that users have interacted with recently

Rather than treating every external Teams conversation as suspicious, the detection focuses specifically on communications involving domains that have not been observed during the baseline period

This significantly reduces noise generated by routine collaboration with trusted vendors, customers, and business partners while highlighting interactions with previously unseen organizations

Detecting New External Teams Communications

Once the baseline has been established, the rule analyzes Microsoft Teams activity occurring during the previous twenty-four hours

The detection currently monitors activities including:

Creation of new Teams chats
Teams call participant events

For each communication, the rule extracts:

The initiating user
External participant information
User and target domains
Client IP addresses
Chat thread identifiers
Operation type and description

To improve identity matching later in the correlation process, the rule enriches external user information using Microsoft Entra Identity data where available, including:

User Principal Name (UPN)
Account name
SAM account name
Display name

This normalization allows subsequent endpoint activity to be correlated even when different identity formats are recorded across Microsoft services

Identifying Remote Management Activity

The second component of the rule searches Microsoft Defender XDR telemetry for evidence of Remote Management and Monitoring software usage

Rather than relying on a static list of applications embedded within the query, the rule imports a maintained catalogue of known RMM tools. This allows the detection to remain current as new products are added to the ecosystem without requiring significant modifications to the detection logic

The rule searches for RMM-related activity across three endpoint telemetry sources:

DeviceProcessEvents
Process creation events are inspected for:
- Execution of known RMM applications
- RMM software launching additional processes
- Parent processes associated with known RMM tools

These events often represent the initial execution of remote access software or subsequent activity initiated by an active remote session

DeviceFileEvents
File creation events are analyzed to identify situations where known RMM executables are written to disk.
This may indicate:
- Installation of remote support software
- Download of an RMM application
- Deployment of portable RMM utilities

Monitoring file creation provides visibility into the early stages of remote access software deployment before execution occurs

DeviceNetworkEvents
Network telemetry is inspected for successful outbound connections initiated by known RMM applications.
These events help identify situations where remote management software has successfully established communication with external infrastructure, indicating that the application is actively being used rather than merely installed.

Identity Correlation Across Services

One of the primary challenges when correlating Microsoft 365 audit logs with endpoint telemetry is the variation in user identity formats

Depending on the telemetry source, a user may appear as:

User Principal Name (UPN)
Account name
SAM account name
Display name
Logged-on device user

To overcome this challenge, the rule enriches endpoint events using both IdentityInfo and DeviceInfo tables

The detection builds multiple potential identity mappings and creates a normalized join key that allows Teams activity to be reliably associated with endpoint events regardless of how the user was recorded in each data source

This normalization substantially improves correlation accuracy and reduces missed detections caused by inconsistent identity formats

Correlating Teams Communication with RMM Activity

After both datasets have been prepared, the rule correlates external Teams communications with subsequent RMM activity performed by the same user

An alert is generated only when:

The Teams interaction occurs before the RMM activity
The RMM activity takes place within four hours of the Teams communication
The user identities successfully correlate across Microsoft Teams and Defender XDR telemetry

By enforcing both temporal sequencing and identity correlation, the detection focuses on behaviors consistent with social engineering rather than isolated administrative activity.

Alert Generation Logic

Unlike detections that trigger solely on RMM execution, this rule requires multiple independent signals before generating an alert

Specifically, the detection verifies that:

A user communicated with an unfamiliar external organization through Microsoft Teams
The same user subsequently executed or used Remote Management software
The events occurred in the expected chronological order
The activity fell within the defined four-hour correlation window

By combining identity, collaboration, endpoint, and temporal context into a single analytic, the rule produces high-confidence alerts that are far more indicative of attacker behavior than either Teams communication or RMM activity alone

Why the Rule Uses Domain Baselines and Time Correlation

One of the primary objectives of this detection is to distinguish legitimate administrative activity from behavior that may indicate a social engineering attack. Both Microsoft Teams and Remote Management and Monitoring (RMM) software are widely used within enterprise environments, making it impractical to alert on either activity independently

To improve fidelity, the rule incorporates two key design decisions

Baseline of Familiar External Domains

Organizations often communicate regularly with customers, vendors, contractors, and business partners through Microsoft Teams. Alerting on every external conversation would quickly overwhelm analysts with benign activity

To address this, the rule establishes a fourteen-day baseline of previously contacted external domains. New Teams communications are only considered suspicious when they involve organizations that have not been observed during the baseline period

This behavioral approach allows the detection to prioritize unexpected interactions while reducing noise generated by routine collaboration

Four-Hour Correlation Window

The rule also requires that RMM activity occur within four hours of the initial Teams communication

This window reflects the typical progression of social engineering attacks, where an attacker first establishes communication before convincing the victim to install or launch remote access software

By enforcing a temporal relationship between the two events, the detection reduces false positives caused by unrelated RMM usage while increasing confidence that the observed activity represents a connected attack sequence

Investigation Guidance

When this detection triggers, analysts should review both the Teams interaction and the associated endpoint activity to determine whether the remote management software was used as part of a legitimate support session or an unauthorized remote access attempt

Recommended investigation steps include reviewing:

Microsoft Teams Activity

The external user’s identity and domain.
Whether the external organization is known or expected.
Chat history and conversation content.
Meeting invitations or call participation.
Shared links or attachments.
Client IP addresses associated with the Teams session.

Endpoint Activity

Determine which RMM application was observed and how it was used.

Review:

Device name and user account
Executed RMM application
Process creation events
Parent and child processes
Command-line arguments
File creation events
Network connections established by the RMM software

User Context

Analysts should determine whether:

The user requested remote support
IT administrators were performing legitimate maintenance
The device belongs to an IT administrator or privileged support account
The user recognizes the external contact

Unexpected remote support sessions involving standard users should be treated as higher priority

Additional Investigation

Investigators should also search for:

Additional endpoint alerts involving the same device
Credential theft activity
PowerShell or scripting activity following the RMM session
Lateral movement
New persistence mechanisms
Additional communications with the same external organization

Understanding what occurred after the RMM session is often more important than confirming that the software was launched

Example Attack Scenarios

Example 1 – Fake IT Support

A user receives a Teams message from an unfamiliar external organization claiming to represent the company’s IT department

During the conversation, the user is instructed to launch a remote support application to resolve an urgent issue.

Within thirty minutes, Defender XDR records execution of a known RMM application on the user’s workstation

The detection correlates both events and generates an alert indicating a potentially successful social engineering attack

Example 2 – External Help Desk Impersonation

An attacker initiates a Teams call while impersonating a third-party service provider

After convincing the employee that a configuration issue requires immediate attention, the attacker instructs the user to install remote management software

The installation generates file creation events followed by process execution and outbound network activity

Because the activity occurs shortly after communication with a previously unseen external domain, the rule generates a high-confidence alert

Example 3 – Suspicious Remote Access Following External Chat

A user begins a new Teams conversation with an unfamiliar external contact

Approximately two hours later, Defender XDR records successful outbound network connections initiated by a commercial RMM application that is not commonly used within the environment

Although neither event alone would necessarily indicate malicious activity, their correlation suggests the possibility of attacker-controlled remote access and warrants immediate investigation

MITRE ATT&CK Mapping

Tactic	Technique ID	Technique
Phishing	T1566	Attackers may initiate social engineering through Microsoft Teams instead of traditional email to establish trust with the victim
Remote Access Software	T1219	The rule specifically detects execution and use of legitimate remote management software that may be abused by attackers
Valid Accounts	T1078	Threat actors frequently persuade victims to authenticate or use legitimate accounts during remote support sessions
Ingress Tool Transfer	T1105	RMM applications may facilitate delivery of additional tools or malware following initial access
Command and Scripting Interpreter	T1059	Remote sessions are often followed by execution of PowerShell or other scripting engines to perform post-compromise activities

Why This Detection Matters

Legitimate remote management software has become one of the preferred tools for modern threat actors because it enables remote access without requiring custom malware. When combined with trusted collaboration platforms such as Microsoft Teams, attackers can leverage familiar business applications to bypass user suspicion and blend into normal organizational activity

Traditional detections that monitor Teams activity or RMM execution independently often generate excessive noise or fail to provide sufficient context for analysts. This rule instead identifies the relationship between the initial social engineering event and the subsequent remote management activity, allowing defenders to focus on behaviors that more closely resemble real-world attack chains

By correlating collaboration telemetry with endpoint events and applying identity normalization, behavioral baselining, and temporal sequencing, the detection provides a high-confidence mechanism for identifying potentially malicious remote access attempts while minimizing false positives

How Wizard Cyber Can Help

Wizard Cyber develops threat-informed behavioral detections that identify malicious activity across identity, cloud, endpoint, and collaboration platforms

Our detection engineering capabilities include:

Microsoft Teams and Microsoft 365 threat detection
Remote Management Tool (RMM) abuse detection
Identity and endpoint behavioral correlation
Microsoft Defender XDR analytics
Microsoft Sentinel detection engineering
Threat-informed detection tuning
Advanced threat hunting and incident response support

By combining telemetry from multiple Microsoft security products into high-fidelity behavioral analytics, Wizard Cyber helps organizations detect sophisticated attack chains that would otherwise remain hidden when events are analyzed in isolation

CYBERSECURITY READINESS

Strengthen Your Cyber Defences Today

As cyber threats grow more complex, proactive detection is no longer optional.

With Wizard Cyber’s Microsoft expertise, organizations can transform their security posture and gain real-time visibility across all endpoints.

Start your journey to smarter, faster cybersecurity today.

EXPLORE MORE

Related Blogs & Insights

Discover blogs that deepen your knowledge and accelerate your security strategy.

Detecting Suspicious PowerShell Command Execution Using Behavioral Scoring

See how behavioral scoring detects suspicious PowerShell commands, catching obfuscation and encoding that static indicators miss.

Detecting Malicious Traffic That Was Allowed Through The Firewall

Learn how to detect malicious traffic allowed through your firewall despite being flagged, using Fortinet logs and Sentinel KQL.

Detecting Boot-Level Persistence In Windows: BCD Abuse And Startup Manipulation

Learn how to detect boot-level persistence in Windows by identifying BCD abuse, bcdedit misuse, and early startup manipulation.

ABOUT THE AUTHOR

Mohammad Eid

SOC Analyst Level 1

Mohammad specialises in detection engineering, Microsoft Sentinel analytics, KQL development, and detection content creation. He supports the continuous improvement of threat detection capabilities across Microsoft security technologies. He holds Microsoft SC-200, AZ-500, and SC-300 certifications

Certifications: SC-200, AZ-500, SC-300