LoFP LoFP / legitimate external partners or managed service providers with help desk-style display names may trigger this rule. validate the sender tenant, domain, and business relationship before closing as benign.

Techniques

Sample rules

M365 Teams Rogue Help Desk Chat Created

Description

Identifies a one-on-one Microsoft Teams chat created by a user from a foreign tenant whose display name, member profile, or email local-part resembles IT help desk or Microsoft security staff. Adversaries abuse cross-tenant Teams external access to impersonate support personnel and socially engineer victims into granting remote access or disclosing credentials.

Detection logic

data_stream.dataset:o365.audit and event.action:"ChatCreated" and event.provider:"MicrosoftTeams" and event.outcome:"success" and
  o365.audit.ParticipantInfo.HasOtherGuestUsers:false and o365.audit.ParticipantInfo.HasGuestUsers:false and
  o365.audit.ParticipantInfo.HasForeignTenantUsers:true and o365.audit.CommunicationType:"OneOnOne" and
  (
    o365.audit.Members:(
      "Help Desk" or "Help Desk Team" or "Help Desk IT" or "IT Help Desk" or
      "Microsoft Security" or "Microsoft  Security" or "Microsoft Support"
    ) or
    user.email:(
      *helpdesk* or *help.desk* or *help-desk* or *help_desk* or
      *ithelp* or *it.help* or *itsupport* or *it.support* or *it-support*
    ) or
    user.name:(*helpdesk* or *help-desk* or *ithelp* or *itsupport*)
  )