Teams Vishing Impersonation of IT Helpdesk Following Email Bombing
Detects Microsoft Teams chat and message events originating from unverified or external tenants that attempt to impersonate internal IT helpdesk personas. This activity is often part of a multi-stage social engineering campaign, potentially following email bombing, where attackers aim to trick users into executing malicious files or installing remote access tools.
Sigma
