Threat video1:00
Microsoft Teams External Tenant Phishing: Detection & IOCs
Attackers pose as IT helpdesk from hijacked or new Entra tenants. Quick Assist then takes over; 9 detection rules, 30 IOCs and a free Splunk SPL rule.
Read the full threat intel for Microsoft Teams External Tenant Phishing: Detection & IOCs →
Chapters
- 0:00The hook2,000+ emails, then fake IT help.
- 0:04The storyTeams lets outsiders call you.
- 0:10Attack pathOften email bombing, then a throwaway tenant.
- 0:23AttributionNo threat actor is attributed.
- 0:28Indicators of compromise21 indicators to hunt: 9 domains, 6 SHA-256 hashes and 1 SHA-1 hash, and more.
- 0:38MITRE ATT&CK techniques21 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation5 steps now: Restrict Teams external access to an allowlist of trusted domains.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:002,000+ emails, then fake IT help.
0:05Teams lets outsiders call you.
0:07They pose as IT help.
0:11Often email bombing, then a throwaway tenant.
0:14They pose as IT in Teams chat.
0:16Victims open Quick Assist.
0:18Fake login pages drop an infostealer.
0:24No threat actor is attributed. Confidence: low.
0:2821 indicators to hunt: 9 domains, 6 SHA-256 hashes and 1 SHA-1 hash, and more.
0:3821 ATT&CK techniques, from reconnaissance to command and control.
0:445 steps now: Restrict Teams external access to an allowlist of trusted domains.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.