Teams Android Heap Disclosure
This rule detects network connections initiated by the 'teams.exe' process to public IP addresses. It specifically looks for outbound connections from the Microsoft Teams application to external, non-private IP ranges. This could be used to monitor unusual external communication patterns from Teams, although the specific intent without further context is unclear.
Microsoft Sentinel (KQL)
