Ransomware via Microsoft Teams TURN Relays
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
Microsoft Sentinel (KQL)
