Pierre Thoor
@pthoor0 followers0 downloads96 copies3 likes1,071 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
6
2
1
1
1
Platforms
6
Products / Services
6
MITRE Techniques
6
6
5
1
1
This rule detects potential social engineering attempts in external direct messages (DMs) by identifying messages that impersonate IT helpdesk or support personnel, or discuss 'working from home' scenarios. It specifically looks for keywords like 'helpdesk', 'help desk', 'IT support', and 'working from home' in the recipient details or sender display name of external messages within the last 5 days. The goal is to surface lures that aim to trick users into revealing sensitive information or performing actions under false pretenses.
This rule detects rare external domains shared in Microsoft Teams messages that users subsequently click on. It identifies messages from external senders, extracts URLs and their domains, and then filters for domains that appear infrequently (less than 3 times in the last day). The rule then correlates these rare external domains with user click events within Teams, surfacing potential phishing attempts or malicious link sharing where users interact with untrusted content.
This rule identifies external domains sending a high number of unique links in Microsoft Teams messages over the last 7 days, excluding common trusted Microsoft domains. It aims to detect potential phishing attempts or unusual external communication patterns that might indicate malicious activity or data exfiltration.
This rule detects messages within Microsoft Teams that have been identified by Microsoft Defender for Office 365 as containing phishing attempts, malware, or spam. It specifically looks for messages with 'Phish', 'Malware', or 'Spam' verdicts in the ThreatTypes field, allowing for quick identification and triage of malicious content.
This rule analyzes URL click events within Microsoft Teams to identify and summarize actions taken on URLs, specifically focusing on Safe Links outcomes. It helps in understanding user interaction with links, potentially identifying malicious link clicks that Safe Links has intercepted or allowed, and assessing the adoption of Safe Links protection within the Teams environment.
This rule identifies instances where users have clicked on URLs within Microsoft Teams. It specifically filters for 'UrlClickEvents' where the 'Workload' is 'Teams' and provides details such as the timestamp, user principal name, URL, URL domain, action type, and network message ID. This can be used to investigate potential phishing attempts or malicious link clicks within the Teams environment.