Mail Bombing Followed by Suspicious Microsoft Teams Chat
Detects scenarios where an account experiences mail bombing activity followed closely by a suspicious Microsoft Teams chat initiation by an external user within a 2-hour window, potentially indicating a multi-stage social engineering or extortion campaign.
Microsoft Sentinel (KQL)
