Analytics Alerts
Browse the Cortex analytics alert reference.
1 alert match the current filters. tactic: TA0001 ✕
Download CSV Show ATT&CK heatmapExternal user started a Microsoft Teams conversation Informational Identity Threat Module, SaaS Threat Detection 5 variations
An external user started a Microsoft Teams conversation with users in the organization.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- 1 Hour
- Deduplication:
- 1 Day
ATT&CK tactics: Initial Access (TA0001)ATT&CK techniques: Phishing (T1566)Required data: Office 365 AuditDetector tags: Microsoft TeamsAttacker's goals: Attackers may leverage Microsoft Teams to conduct phishing attacks by exploiting trusted communication channels with users inside the organization.Investigative actions: Confirm that the tenant and user are authorized to start a conversation with users in the organization. Verify the content of the conversation and validate that there is no phishing attempt being made. Inspect links and URLs that might have been sent in the conversation. Check external domain reputation. Review past communication from the external user. Follow further actions done by the account.Variations
An external user started multiple conversations in Microsoft Teams with suspicious chat names
Low overridden
An external user started a Microsoft Teams conversation with users in the organization. overridden
An external user started a conversation in Microsoft Teams with a suspicious user or chat name
Low overridden
An external user started a Microsoft Teams conversation with users in the organization. overridden
An external user started multiple conversations in Microsoft Teams
Low overridden
An external user started a Microsoft Teams conversation with users in the organization. overridden
External user started a Microsoft Teams conversation and sent a message
Informational overridden
An external user started a Microsoft Teams conversation with users in the organization. overridden
An external user started conversations in Microsoft Teams with many internal users
Informational overridden
An external user started a Microsoft Teams conversation with users in the organization. overridden