← Back to SOC feed Coverage →

Suspicious Teams Display Name

kql MEDIUM Azure-Sentinel
T1566
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-12T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use misleading display names in Teams to impersonate legitimate users and gain trust for phishing or credential theft. SOC teams should proactively hunt for this behavior to identify potential identity spoofing and early-stage compromise attempts in their Azure Sentinel environment.

KQL Query

let SuspiciousDisplayNames = pack_array("Microsoft  Security", "Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "IT Support", "Helpdesk");
MessageEvents
| where IsExternalThread == 1 and IsOwnedThread == 0
| where SenderDisplayName has_any (SuspiciousDisplayNames)

Analytic Rule Definition

id: 97e1c837-2cef-4f43-a87f-11f16e33ee8d
name: Suspicious Teams Display Name
description: |
  This query looks for Teams messages from an external user with a suspicious display name.
description-detailed: |
  This query looks for Teams messages from an external user with a suspicious display name.
  Threat actors may attempt to socially engineer a user by using display names such as IT Support or Help Desk to establish trust.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let SuspiciousDisplayNames = pack_array("Microsoft  Security", "Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "IT Support", "Helpdesk");
  MessageEvents
  | where IsExternalThread == 1 and IsOwnedThread == 0
  | where SenderDisplayName has_any (SuspiciousDisplayNames)
version: 1.0.0

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Suspicious Teams Display Name.yaml