Microsoft Teams TURN Relay Anomalous Traffic
Detects anomalous outbound connections to Microsoft Teams TURN relays from non-Teams processes. This behavior can be indicative of malware, such as Backdoor.Turn, abusing legitimate Microsoft Teams infrastructure for command and control or data exfiltration, by masquerading malicious traffic as legitimate conferencing application traffic.
Microsoft Sentinel (KQL)
