External Teams 1:1 chat from IT Support impersonator (Black Basta)

ills3c Intel&Coffee@Ills3C

•updated yesterday•9•0•14

Detects Microsoft Teams chat creation events originating from an external sender whose user ID or display name impersonates IT support (e.g., IT Support, Help Desk, Service Desk), often used in social engineering or phishing attempts.