Microsoft Teams Impersonation Detected

Ahamed Rizvan@ahamedrizvan

•updated Aug 3, 2025•7•0•210

This rule detects an impersonation event within Microsoft Teams, specifically when the 'TeamsImpersonationDetected' action type is logged. It extracts the User ID and the Sender's User Principal Name (UPN) associated with the detected impersonation.