-
Identifies when external access is enabled in Microsoft Teams. External access lets Teams and Skype for Business users communicate with other users that are outside their organization. An adversary may enable external access or add an allowed domain to exfiltrate data or maintain persistence in an environment.
Read More -
Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment.
Read More -
M365 Teams Custom Application Interaction Enabled
Sep 19, 2026 · Domain: Cloud Data Source: Microsoft 365 Use Case: Configuration Audit Tactic: Defense Evasion Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: Microsoft 365 Domain: SaaS Data Source: Microsoft 365 Audit Logs Service: Microsoft Teams ·Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may abuse this behavior to establish persistence in an environment.
Read More -
M365 Teams Rogue Help Desk Chat Created
Sep 19, 2026 · Domain: Cloud Domain: SaaS Data Source: Microsoft 365 Data Source: Microsoft 365 Audit Logs Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: Microsoft 365 Domain: Email Service: Microsoft Teams ·Identifies a one-on-one Microsoft Teams chat created by a user from a foreign tenant whose display name, member profile, or email local-part resembles IT help desk or Microsoft security staff. Adversaries abuse cross-tenant Teams external access to impersonate support personnel and socially engineer victims into granting remote access or disclosing credentials.
Read More