Analytics
Informational
✕
External user call via Microsoft Teams
An external user called a user in the organization via Microsoft Teams.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Office 365 Audit
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing: Spearphishing Voice (T1566.004)
Detector tags: Microsoft Teams
Attacker's goals:
Attackers may leverage Microsoft Teams to conduct voice phishing attacks by exploiting trusted communication channels with users inside the organization.
Investigative actions:
Confirm that the external tenant and external user are authorized to call users in the organization. Check external domain reputation. Follow further actions performed by the user who participated in the call. Verify if the user account was compromised or was a victim of a voice phishing campaign.
- Test period:
- 10 Minutes
- Deduplication:
- 1 Day
2 variations:
- A first seen external user with a suspicious name initiated a Microsoft Teams call Medium (parent: Informational)
- An external user with a suspicious name initiated a Microsoft Teams call Low (parent: Informational)