Analytics
Informational
✕
External user started a Microsoft Teams conversation
An external user started a Microsoft Teams conversation with users in the organization.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Office 365 Audit
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Phishing (T1566)
Detector tags: Microsoft Teams
Attacker's goals:
Attackers may leverage Microsoft Teams to conduct phishing attacks by exploiting trusted communication channels with users inside the organization.
Investigative actions:
Confirm that the tenant and user are authorized to start a conversation with users in the organization. Verify the content of the conversation and validate that there is no phishing attempt being made. Inspect links and URLs that might have been sent in the conversation. Check external domain reputation. Review past communication from the external user. Follow further actions done by the account.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day
5 variations:
- An external user started multiple conversations in Microsoft Teams with suspicious chat names Low (parent: Informational)
- An external user started a conversation in Microsoft Teams with a suspicious user or chat name Low (parent: Informational)
- An external user started multiple conversations in Microsoft Teams Low (parent: Informational)
- External user started a Microsoft Teams conversation and sent a message Informational
- An external user started conversations in Microsoft Teams with many internal users Informational