Teams external fake IT help desk chat following mail-bomb burst (STAC4749)

ills3c Intel&Coffee@Ills3C

•updated yesterday•2•0•4

Detects a potential multi-stage social engineering attack where a user first receives a high volume of emails (mail-bomb burst) within a short window, followed shortly by an external Microsoft Teams message from a suspicious throwaway tenant using an IT help desk display name.