Suspicious Cross-Tenant Teams Message with URL or File Reference (T1566.002/T1534)
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Microsoft Sentinel (KQL)
