Downloads from Microsoft Teams / Zoom Chat Links
This query searches for users who received a download link via a chat in MS teams or zoom and have clicked the link. (this query looks for a browser invoke to confirm) This rule breaks Safelinks and extract the URL, and looks for suspicious extensions that are typically malicious
Cortex XDR
