High Precision Teams Impersonation Detection

Based on eSentire TRU dataset: https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat

Microsoft Sentinel (KQL)