Microsoft Teams lookalike phishing domains in network connections
Detects outbound network connections to hosts containing 'teams' along with typical phishing lure words (cloud, login, update, portal) where the registered domain is not a legitimate Microsoft domain. This is commonly indicative of credential harvesting or phishing infrastructure targeting Microsoft Teams users.
Microsoft Sentinel (KQL)
