Microsoft Teams Help-Desk Vishing + RMM Lateral Movement: OTX Pulse Detection Pack

---
title: Microsoft Teams Help-Desk Social Engineering Leading to Suspicious Child Process
id: 9f2c0e9a-7b6f-4d20-a9db-teams-helpdesk-childproc
status: experimental
description: Detects Microsoft Teams or Edge/Teams WebView spawning script interpreters, LOLBins, or RMM tooling consistent with fake help-desk calls and user-assisted execution.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
  service: sysmon
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1204
  - attack.t1219
  - attack.t1059
detection:
  parent_teams:
    ParentImage|endswith:
      - '\Teams.exe'
      - '\ms-teams.exe'
      - '\msedgewebview2.exe'
      - '\explorer.exe'
  child_suspicious:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\cmd.exe'
      - '\quickassist.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\ScreenConnect.Client.exe'
      - '\ScreenConnect.WindowsClient.exe'
  cmdline_suspicious:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'iex'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'FromBase64String'
      - '-enc'
      - '-e '
      - 'bypass'
      - 'hidden'
      - 'msiexec'
      - 'certutil'
      - 'bitsadmin'
  condition: parent_teams and child_suspicious and cmdline_suspicious
falsepositives:
  - Legitimate help desk using approved RMM with change ticket
  - IT support scripts launched after verified callback
references:
  - https://cybersecuritynews.com/hackers-weaponize-microsoft-teams/
date: 2026/09/04
modified: 2026/09/04
---
title: OTX Pulse IPv4 Network Indicators - Teams Help-Desk Intrusion Set
id: 4a2fd0d9-6b1f-42f0-a4b1-otx-teams-ipv4-watch
status: experimental
description: Network connection to OTX-listed IPv4 indicators associated with Teams help-desk social engineering and lateral movement. Deploy at firewall, proxy, DNS resolver, Zeek/Suricata, or EDR network telemetry where supported.
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
  service: sysmon
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1219
  - attack.lateral_movement
detection:
  dst_ip_otx:
    DestinationIp:
      - '5.181.3.106'
      - '178.130.47.46'
      - '80.66.72.215'
      - '185.155.99.161'
      - '45.8.157.185'
      - '2.56.172.214'
      - '185.234.67.53'
      - '136.0.20.6'
  process_interesting:
    Image|endswith:
      - '\Teams.exe'
      - '\ms-teams.exe'
      - '\powershell.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\ScreenConnect.Client.exe'
      - '\mstsc.exe'
      - '\winrm.cmd'
      - '\wsmprovhost.exe'
  condition: dst_ip_otx and process_interesting
falsepositives:
  - Rare if IP reputation is validated; still suppress only approved RMM vendor ranges after ticketing.
references:
  - https://cybersecuritynews.com/hackers-weaponize-microsoft-teams/
date: 2026/09/04
modified: 2026/09/04
---
title: Post-Help-Desk Intrusion Persistence via RMM Service, Run Key, or Remote Access Enablement
id: 7f1db9b7-6b95-4d5f-b2de-rmm-persistence-remoteaccess
status: experimental
description: Detects persistence or remote-access enablement shortly after user-assisted support scams: new services, Run keys, RDP enablement, local admin creation, or RMM installation paths.
author: Security Arsenal
logsource:
  category: registry_event
  product: windows
  service: sysmon
level: high
tags:
  - attack.persistence
  - attack.t1543.003
  - attack.t1547.001
  - attack.t1136
  - attack.t1021.001
  - attack.t1219
detection:
  reg_persistence:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
      - '\Services\'
      - '\Control\Terminal Server\fDenyTSConnections'
      - '\Lsa'
      - '\Winlogon'
  reg_value_suspicious:
    Details|contains:
      - 'powershell'
      - 'mshta'
      - 'rundll32'
      - 'AnyDesk'
      - 'TeamViewer'
      - 'ScreenConnect'
      - 'QuickAssist'
      - 'AppData\Local\Temp'
      - 'ProgramData'
  condition: reg_persistence and reg_value_suspicious
falsepositives:
  - Managed software deployment and approved RMM inventory
  - Help-desk tools installed through Intune/SCCM with approved package IDs
references:
  - https://cybersecuritynews.com/hackers-weaponize-microsoft-teams/
date: 2026/09/04
modified: 2026/09/04

let OtxIps = dynamic(['5.181.3.106','178.130.47.46','80.66.72.215','185.155.99.161','45.8.157.185','2.56.172.214','185.234.67.53','136.0.20.6']);
let SuspiciousProcs = dynamic(['powershell.exe','pwsh.exe','mshta.exe','rundll32.exe','wscript.exe','cscript.exe','cmd.exe','quickassist.exe','AnyDesk.exe','TeamViewer.exe','ScreenConnect.Client.exe','ScreenConnect.WindowsClient.exe','mstsc.exe','wsmprovhost.exe']);
union withsource=src
(
  DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemoteIP in (OtxIps)
  | project src, TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessParentFileName, InitiatingProcessCommandLine, LocalIP, LocalPort, RemoteIP, RemotePort, RemoteUrl, ActionType
),
(
  DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where (InitiatingProcessFileName in~ ('Teams.exe','ms-teams.exe','msedgewebview2.exe','explorer.exe') and FileName in~ (SuspiciousProcs))
     or (ProcessCommandLine has_any ('iex','DownloadString','FromBase64String','-enc','bypass','hidden','AnyDesk','TeamViewer','ScreenConnect','quickassist'))
  | project src, TimeGenerated, DeviceName, DeviceId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName, InitiatingProcessCommandLine, AccountName, AccountDomain, SHA256, FolderPath
)
| extend IndicatorMatch = iif(RemoteIP in (OtxIps), 'OTX IPv4', 'Behavior')
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), Processes=make_set(FileName,10), Parents=make_set(InitiatingProcessFileName,10), CommandLines=make_set(strcat(substring(ProcessCommandLine,0,220)),5), RemoteEndpoints=make_set(strcat(RemoteIP,':',tostring(RemotePort)),10) by DeviceName, DeviceId, AccountName, IndicatorMatch
| order by Hits desc;

# Security Arsenal hunt: Teams help-desk vishing IOC/artifact sweep
$ErrorActionPreference = 'SilentlyContinue'
$OtxIps = @('5.181.3.106','178.130.47.46','80.66.72.215','185.155.99.161','45.8.157.185','2.56.172.214','185.234.67.53','136.0.20.6')
$RmmNames = 'AnyDesk|TeamViewer|ScreenConnect|QuickAssist|Atera|Splashtop|ZohoAssist|LogMeIn|RustDesk'

Write-Host '[*] Active/historical TCP connections to OTX IPv4 indicators'
Get-NetTCPConnection | Where-Object { $OtxIps -contains $_.RemoteAddress } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}},@{n='Path';e={(Get-Process -Id $_.OwningProcess).Path}}

Write-Host '[*] Listening services/processes resembling RMM or remote access'
Get-CimInstance Win32_Service | Where-Object { $_.Name -match $RmmNames -or $_.PathName -match $RmmNames -or $_.DisplayName -match $RmmNames } | Select-Object Name,DisplayName,State,StartMode,PathName
Get-Process | Where-Object { $_.ProcessName -match $RmmNames } | Select-Object ProcessName,Id,Path,StartTime

Write-Host '[*] Persistence: Run keys and scheduled tasks with suspicious command lines'
$RunKeys = @('HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($k in $RunKeys) { Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'powershell|mshta|rundll32|AnyDesk|TeamViewer|ScreenConnect|Temp|ProgramData' } | Select-Object @{n='Key';e={$k}},Name,@{n='Value';e={$_.Value}} } }
Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match 'powershell|mshta|rundll32|wscript|cscript') -or ($_.Actions.Arguments -match 'iex|DownloadString|FromBase64String|-enc|bypass|hidden|AnyDesk|TeamViewer|ScreenConnect') } | Select-Object TaskName,TaskPath,State,@{n='Execute';e={$_.Actions.Execute}},@{n='Arguments';e={$_.Actions.Arguments}}

Write-Host '[*] Remote access enablement and local admin anomalies'
Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' | Select-Object fDenyTSConnections
Get-LocalGroupMember -Group 'Administrators' | Select-Object Name,PrincipalSource,ObjectClass
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon' | Select-Object AutoAdminLogon,DefaultUserName,DefaultDomainName

Write-Host '[*] Recent likely drop locations and Teams/WebView cache artifacts'
$paths = @("$env:LOCALAPPDATA\Temp","$env:APPDATA","$env:LOCALAPPDATA\Microsoft\Teams","$env:LOCALAPPDATA\Packages\MSTeams_8wekyb3d8bbwe","$env:USERPROFILE\Downloads")
foreach ($p in $paths) { Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and ($_.Name -match '\.exe$|\.msi$|\.ps1$|\.js$|\.vbs$|\.hta$|\.zip$|\.iso$|\.img$|AnyDesk|TeamViewer|ScreenConnect|quickassist') } | Select-Object FullName,Length,CreationTime,LastWriteTime }

Write-Host '[*] Defender/EDR relevant tamper signals'
Get-MpPreference | Select-Object DisableRealtimeMonitoring,DisableBehaviorMonitoring,DisableIOAVProtection,DisableScriptScanning,ExclusionPath,ExclusionProcess
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 200 | Where-Object { $_.Id -in 5001,5007,5013 } | Select-Object TimeCreated,Id,Message