Microsoft Teams IT Helpdesk Impersonation
This rule detects Microsoft Teams activities such as ChatCreated, MessageSent, or TeamsImpersonationDetected where the sender's display name matches common administrative or support-themed identifiers (e.g., 'IT Support', 'Help Desk', 'Global Admin'). This behavior is commonly associated with social engineering and phishing attempts designed to trick users into divulging credentials or sensitive information by masquerading as trusted enterprise support roles.
Cortex XDR
