Data Exfiltrated via Teams Webhook Connector

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects potential data exfiltration attempts via Microsoft Teams webhook connectors. It specifically looks for HTTP POST requests to 'outlook.office.com' with a URI containing '/webhook/' and a data size greater than 500 bytes. This combination suggests that data might be sent out through a Teams webhook, which can be abused for exfiltration.