Teams external IT helpdesk impersonation chat following a mail bomb

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•1

Detects a potential social engineering or phishing attack pattern where a recipient first receives a high volume of inbound emails (mail flood) within a short window, followed quickly by an external Microsoft Teams chat message from an IT-themed sender attempting to impersonate internal support.