Display Name - Detect Teams IT Helpdesk Impersonation Msg Phishing & Vishing

Hunt Hypothesis

This hypothesis targets adversaries leveraging the trusted internal IT helpdesk persona within Microsoft Teams to execute phishing or vishing attacks, a common initial access vector that bypasses traditional email filters. Proactively hunting for these impersonation attempts is critical in Azure Sentinel to identify social engineering campaigns that exploit user trust and facilitate credential theft or malicious file execution before they propagate across the organization.

KQL Query

let TeamsVishing =
CloudAppEvents
| where Timestamp > ago(1h)
| where Application == @"Microsoft Teams" and ActionType == @"CallParticipantDetail" and tostring(RawEventData.Attendees) has "@"
| extend CallerPSTN = tostring(RawEventData.UserId)
| extend Domain = tostring(split(CallerPSTN, "@")[1])
| extend Caller = tostring(split(CallerPSTN, "@")[0])
| where CallerPSTN has "onmicrosoft.com" and (CallerPSTN has "helpdesk" or CallerPSTN has "support" or CallerPSTN has "admin")
| distinct Caller, Domain;
CloudAppEvents
| where Timestamp > ago(1h)
| where Application == "Microsoft Teams" and ActionType == "ChatCreated" and IsExternalUser == true
| extend ThreadCreatorUpn = tostring(RawEventData.Members[0].UPN)
    ,ThreadCreatorDisplayName = tostring(RawEventData.Members[0].DisplayName)
    ,ThreadCreatorOrganizationId = tostring(RawEventData.Members[0].OrganizationId)
    ,TRecipient1Upn = tostring(RawEventData.Members[1].UPN)
    ,Recipient1DisplayName = tostring(RawEventData.Members[1].DisplayName)
    ,Recipient1OrganizationId = tostring(RawEventData.Members[1].OrganizationId)
    ,Recipient2Upn = tostring(RawEventData.Members[2].UPN)
    ,Recipient2DisplayName = tostring(RawEventData.Members[2].DisplayName)
    ,Recipient2OrganizationId = tostring(RawEventData.Members[2].OrganizationId)
    ,ThreadId = tostring(RawEventData.ChatThreadId)
| where ThreadCreatorUpn has "onmicrosoft.com" and (ThreadCreatorUpn has "helpdesk" or ThreadCreatorUpn has "support" or ThreadCreatorUpn has "admin")
| summarize by ThreadCreatorUpn, ThreadCreatorDisplayName, ThreadCreatorOrganizationId,
    TRecipient1Upn, Recipient1DisplayName, Recipient1OrganizationId,
    Recipient2Upn, Recipient2DisplayName, Recipient2OrganizationId,
    ThreadId, tostring(IsExternalUser), tostring(IsImpersonated)
| union TeamsVishing

Analytic Rule Definition

id: d9fee5bc-e4f8-4ae2-a729-dc399a419cce
name: Display Name - Detect Teams IT Helpdesk Impersonation Msg Phishing & Vishing
description: |
  This query check Teams IT helpdesk impersonation initial access via Teams chat and voice
description-detailed: |
  This query check Teams IT helpdesk impersonation initial access via Teams chat and voice
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
   let TeamsVishing =
   CloudAppEvents
   | where Timestamp > ago(1h)
   | where Application == @"Microsoft Teams" and ActionType == @"CallParticipantDetail" and tostring(RawEventData.Attendees) has "@"
   | extend CallerPSTN = tostring(RawEventData.UserId)
   | extend Domain = tostring(split(CallerPSTN, "@")[1])
   | extend Caller = tostring(split(CallerPSTN, "@")[0])
   | where CallerPSTN has "onmicrosoft.com" and (CallerPSTN has "helpdesk" or CallerPSTN has "support" or CallerPSTN has "admin")
   | distinct Caller, Domain;
   CloudAppEvents
   | where Timestamp > ago(1h)
   | where Application == "Microsoft Teams" and ActionType == "ChatCreated" and IsExternalUser == true
   | extend ThreadCreatorUpn = tostring(RawEventData.Members[0].UPN)
       ,ThreadCreatorDisplayName = tostring(RawEventData.Members[0].DisplayName)
       ,ThreadCreatorOrganizationId = tostring(RawEventData.Members[0].OrganizationId)
       ,TRecipient1Upn = tostring(RawEventData.Members[1].UPN)
       ,Recipient1DisplayName = tostring(RawEventData.Members[1].DisplayName)
       ,Recipient1OrganizationId = tostring(RawEventData.Members[1].OrganizationId)
       ,Recipient2Upn = tostring(RawEventData.Members[2].UPN)
       ,Recipient2DisplayName = tostring(RawEventData.Members[2].DisplayName)
       ,Recipient2OrganizationId = tostring(RawEventData.Members[2].OrganizationId)
       ,ThreadId = tostring(RawEventData.ChatThreadId)
   | where ThreadCreatorUpn has "onmicrosoft.com" and (ThreadCreatorUpn has "helpdesk" or ThreadCreatorUpn has "support" or ThreadCreatorUpn has "admin")
   | summarize by ThreadCreatorUpn, ThreadCreatorDisplayName, ThreadCreatorOrganizationId,
       TRecipient1Upn, Recipient1DisplayName, Recipient1OrganizationId,
       Recipient2Upn, Recipient2DisplayName, Recipient2OrganizationId,
       ThreadId, tostring(IsExternalUser), tostring(IsImpersonated)
   | union TeamsVishing
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spoof and Impersonation/Detect Teams IT Helpdesk Impersonation Msg Phishing & Vishing.yaml)

False Positive Guidance

• Scenario: A legitimate IT Service Desk agent uses Microsoft Teams to initiate a voice call or send a chat message to a user to verify a password reset request or troubleshoot a login issue, triggering the detection because the message contains keywords like “IT Helpdesk,” “verify,” or “call back.”
  • Filter/Exclusion: Exclude messages where the sender is a member of a specific security group (e.g., IT-Support-Team or Service-Desk-Agents) and the conversation thread is associated with an existing ServiceNow or Jira ticket ID referenced in the message body.
• Scenario: An automated onboarding or offboarding workflow sends a standard Teams chat message to new hires or departing employees from a shared mailbox or bot account (e.g., IT-Onboarding@company.com) that includes generic phrasing like “Please contact IT Helpdesk if you have questions,” which matches the keyword-based phishing heuristic.
  • Filter/Exclusion: Exclude senders that are identified as Mailbox type objects in Azure AD or are part of a defined list of known service accounts/bots (e.g., IT-Bot, Onboarding-System) rather than individual user accounts.
• Scenario: A project manager or team lead manually forwards a standard IT troubleshooting guide or a “How to reset your password” article via Teams chat to a group of users, where the text content includes phrases like “IT Helpdesk will assist you” or “voice support available,” causing a false positive due to natural language matching.
  • Filter/Exclusion: Exclude messages where the sender is not in the IT department (based on Azure AD department attribute) and the message length exceeds a certain threshold (e.g., >500 characters), suggesting it is a shared document or guide rather than a short, direct impersonation attempt.
• Scenario: A user initi