Threat video1:00
Microsoft Teams Lookalikes in Search Ads: Detection & IOCs
Attackers reach lookalike Teams domains via sponsored ads, an AI search answer and SEO poisoning. 9 detection rules, 9 IOCs and a free Splunk SPL rule.
Read the full threat intel for Microsoft Teams Lookalikes in Search Ads: Detection & IOCs →
Chapters
- 0:00The hook3 lookalike Teams domains, reached through search.
- 0:04The storyCloned Teams pages on lookalike domains.
- 0:10Attack pathLookalike domain registered, sponsored search ads.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise5 indicators to hunt: 4 domains and 1 file name.
- 0:36MITRE ATT&CK techniques7 ATT&CK techniques, from resource development to stealth.
- 0:41Remediation4 steps now: Block teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live in DNS and web filtering.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:003 lookalike Teams domains, reached through search.
0:05Cloned Teams pages on lookalike domains.
0:08Search, not email, delivered them.
0:11Lookalike domain registered, sponsored search ads.
0:14AI answers and rank added reach.
0:17Cloned Teams pre-join page hosted.
0:19Fake update prompt downloads a staged lure.
0:22Reported aim: work credentials.
0:27No threat actor is attributed. Confidence: low.
0:315 indicators to hunt: 4 domains and 1 file name.
0:377 ATT&CK techniques, from resource development to stealth.
0:414 steps now: Block teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live in DNS and web filtering.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.