All Detections

Suspicious Teams Display Name

Azure Sentinel@AzureSentinel
updated Jun 19, 20258056

This query looks for Teams messages from an external user with a suspicious display name.

Microsoft Sentinel (KQL)