Microsoft Teams External Vishing & Impersonation Detection
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Cortex XDR
