Microsoft Teams External Link Phishing
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing Top-Level Domains (TLDs). The rule specifically looks for messages in one-on-one chats containing external links with TLDs commonly associated with phishing, such as '.ru', '.dev', '.xyz', and others, which could indicate Phishing-as-a-Service (PhaaS) infrastructure or device code lure paths.
Cortex XDR
