The precondition list is where the engineering decision actually sits. Unit 42 gives four: the attacker can start Teams chats and calls from an external tenant, the target believes the caller is IT and launches the tool, the endpoint is permitted to talk to C2, SMB and domain controllers, and the relay preconditions around authentication, signing and certificate services remain in place [9]. Three of those are configuration states somebody in your organisation set, and the fourth is a person reading a display name [22].
The chain is also broken into four confirmation stages, and the first two are a chat or short call arriving from an external Teams ID, then the user answering and starting to interact [19]. Nothing has executed yet at that point, so half the documented chain sits outside the reach of endpoint tooling [23], which is why the identity indicators carry the load: chats and calls from external onmicrosoft.com tenants, and the same external ID touching several users in a short window [14].
Read the Quick Assist mitigation as a statement about the default. Approval has to be required in order to stop standard users from running it [11], so today a standard user can start the session. The endpoint indicator list puts QuickAssist.exe next to unauthorized RMM [17], meaning the process name does not tell you which one you are looking at; only the surrounding authorisation record does, and that record is the thing the mitigation asks you to create.
Campaign B's relay attempt failing is a property of the Active Directory configuration in the environments Unit 42 watched, not of the technique [8]. The report names the precondition categories but not which control held [9]. For that outcome to transfer to your estate, SMB signing, NTLM restrictions and Extended Protection for Authentication would already have to be where the remediation list wants them [13]. Absent that, the finding is best read as blocked in that environment specifically, not blocked as a rule.
One artifact is unusually cheap to alert on. The Campaign B payload arrives from an S3 URL that contains the target's name, alongside traffic to san-sid.com [18]. A per-target string in a proxy log is a high-signal detection that does not depend on decoding obfuscated PowerShell [5].
Unit 42 also logged many failed and missed calls [20], which is the most help-desk-like detail in the whole campaign.
Of the listed mitigations, restricting external Teams communication to business needs and verifying external callers on a separate channel are the only two that act before the call lands [10]. Everything else on the list catches execution after the target has already been convinced [12].
