Malicious Link Delivered via Teams Message

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects HTTP traffic to 'teams.microsoft.com' with a URI containing '/messages/'. It is designed to identify potential social engineering attempts where malicious links are delivered via Microsoft Teams messages. The rule uses a threshold of 5 occurrences within 60 seconds from the same source IP to reduce false positives.