Analytics Informational
✕

External user created a Microsoft Teams conversation with suspicious operations

An external user created a Microsoft Teams conversation with users in the organization with additional suspicious operations.

Module:
Identity Threat Detection (ITDR), SaaS Threat Detection
Licensed by:
Identity Threat Detection (ITDR)
Data source:
Office 365 Audit
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing (T1566)
Detector tags: Microsoft Teams
Attacker's goals:

Attackers may leverage Microsoft Teams to conduct phishing attacks by exploiting trusted communication channels with users inside the organization.

Investigative actions:

Confirm that the tenant and user are authorized to start a conversation with users in the organization. Verify whether any user was removed from the conversation, and determine the reason for their removal. Verify the content of the conversation and validate that there is no phishing attempt being made. Inspect links and URLs that might have been sent in the conversation. Check external domain reputation. Review past communication from the external user. Follow further actions done by the account.

Test period:
3 Hours
Deduplication:
1 Day
9 variations:
  • An external user initiated a Microsoft Teams chat in which a suspicious link was shared and a member was removed Low (parent: Informational)
  • An external user created a chat and shortly after sent a link with a newly seen domain name Low (parent: Informational)
  • An external user initiated a Microsoft Teams chat in which a link was shared and a member was removed Low (parent: Informational)
  • An external user created a chat then sent a link with a file for the first time via Microsoft Teams Low (parent: Informational)
  • An external user created a chat with a suspicious user or chat name and then sent a link via Microsoft Teams Low (parent: Informational)
  • External user created a Microsoft Teams conversation with a suspicious user or chat name and shortly after removed a user from it Low (parent: Informational)
  • An external user created a chat then sent a link via Microsoft Teams Informational
  • An external user created a chat and then sent a link via Microsoft Teams Informational
  • External user created a Microsoft Teams conversation and shortly after removed a user from it Informational