Teams Chat Messages Scraped for Credentials

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects suspicious activity related to Microsoft Teams chat messages being scraped for credentials. Specifically, it looks for HTTP requests to 'graph.microsoft.com' with URIs containing '/chats/' and '/messages'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential automated data exfiltration or credential harvesting from Teams chats.