Microsoft Teams Suspicious App Installation and Bot Abuse
Detects suspicious app installations, custom app creation, and bot additions in Microsoft Teams. This includes sideloaded apps, which can bypass Teams store vetting and be used for persistence, custom app creation outside of development teams, which may indicate C2 bots or data exfiltration, and the addition of bots with suspicious names. The rule also flags operations like AppShared and TabAdded as medium risk.
Cortex XDR
