Teams Phishing S3 Direct Download (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•6•0•4

Detects the initial phishing delivery vector: Microsoft Teams spawning a process which downloads from AWS S3 buckets.