Rare External Domains with Clicks in Teams
This rule detects rare external domains shared in Microsoft Teams messages that users subsequently click on. It identifies messages from external senders, extracts URLs and their domains, and then filters for domains that appear infrequently (less than 3 times in the last day). The rule then correlates these rare external domains with user click events within Teams, surfacing potential phishing attempts or malicious link sharing where users interact with untrusted content.
Microsoft Sentinel (KQL)
