All Detections

Oyster Delivery via Teams FakeApp and Script Download Detection

avatar
Kaung Khant Ko@kaungkhantko
updated Oct 17, 202561168

Detects the Oyster delivery via Teams FakeApp by identifying specific HTTP request patterns, including OPTIONS/POST to /create/link and GET to /gov/ paths and

Microsoft Sentinel (KQL)