Teams External Chat Hunt: Fake IT Support Senders and Known Campaign Tenants
Detects external Microsoft Teams messages containing support-related social engineering lures or originating from known malicious/IOC tenant domains, summarizing sender and thread metrics. The query ran without errors in a live tenant.
Microsoft Sentinel (KQL)
