PowerShell Execution via Microsoft Teams or External Chat Lure

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•3•0•6

Detects instances where PowerShell is spawned directly from Microsoft Teams processes or via explorer.exe shortly after receiving an external chat message in Teams. This pattern is often associated with social engineering lures, such as the 'paste-and-run' attack chain used to facilitate malicious activity.