Defending Against Microsoft Teams Vishing and Chaos Ransomware

---
title: Microsoft Teams External User Invitation - Potential Vishing Setup
id: 8a2f1b44-9d3e-4a5c-b612-3e4a5f901234
status: experimental
description: Detects the addition of external users to Microsoft Teams, often a precursor to vishing attacks. Attackers add targets as guests to initiate calls.
references:
  - https://attack.mitre.org/techniques/T1566/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.initial_access
  - attack.t1566
logsource:
  product: m365
  service: audit
detection:
  selection:
    Operation|contains:
      - 'Add member'
      - 'Invite external user'
    TargetType: 'Group'
  condition: selection
falsepositives:
  - Legitimate B2B collaboration with external partners
level: low
---
title: Chaos Ransomware Behavior - Vssadmin Shadow Copy Deletion
id: 9b3g2c55-0e4f-5b6d-c723-4f5b9g012345
status: experimental
description: Detects attempts to delete Volume Shadow Copies using vssadmin, a common tactic used by Chaos ransomware to prevent recovery.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  condition: selection
falsepositives:
  - System administration scripts (rare)
level: critical
---
title: Potential Chaos Ransomware Execution Pattern
id: 1c4d3e66-1f5g-6c7e-d834-5g6c0h123456
status: experimental
description: Detects execution of binaries from suspicious directories often used by Chaos droppers, followed by rapid file system modifications or encryption markers.
references:
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\\ms_teams.exe'
      - '\browser.exe'
      - '\\outlook.exe'
    Image|contains:
      - '\\Downloads\'
      - '\\AppData\\Local\\Temp\'
    Image|endswith:
      - '.exe'
      - '.bat'
      - '.cmd'
  filter_legit:
    Image|contains:
      - '\\Microsoft\\TeamsMeetingAddin\'
      - '\\Microsoft\\Teams\'
  condition: selection and not filter_legit
falsepositives:
  - Users launching legitimate installers from Downloads
level: high

// Hunt for Teams External Invites correlated with process execution
let TeamInvites = OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation == \"MemberAdded\" or Operation == \"GuestUserInvited\"
| extend UserId = tolower(UserId), TargetUser = tolower(TargetUserOrGroupName)
| project TimeGenerated, Operation, UserId, TargetUser, ClientIP;
let SuspiciousProcesses = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine contains \"delete shadows\" 
   or (FolderPath contains @\"\\Downloads\\" and ProcessVersionInfoOriginalFileName != \"Teams.exe\")
| project DeviceName, InitiatingProcessFileName, ProcessCommandLine, TimeGenerated;
TeamInvites
| join kind=inner SuspiciousProcesses on $left.UserId == $right.InitiatingProcessFileName
| summarize count() by bin(TimeGenerated, 1h), UserId, DeviceName
| sort by count_ desc

-- Hunt for Chaos Ransomware Indicators
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username 
FROM pslist()
WHERE Name =~ \"vssadmin.exe\" 
   AND CommandLine =~ \"delete shadows\"

-- Check for Ransom Notes in User Directories
SELECT FullPath, Size, Mtime
FROM glob(globs=\"/*/*/readme.txt\", root=string(env=\"SystemDrive\"))
WHERE Size < 100000
   -- Chaos notes are often small text files
LIMIT 50

<#
.SYNOPSIS
    Harden Microsoft Teams against external vishing attacks.
.DESCRIPTION
    This script checks the current Teams federation and guest access settings 
    and recommends/configures strict blocking for external domains not allow-listed.
#>

Write-Host \"[+] Auditing Microsoft Teams External Access Policies...\" -ForegroundColor Cyan

# Check if Teams PowerShell Module is installed
if (-not (Get-Module -ListAvailable -Name MicrosoftTeams)) {
    Write-Host \"[!] MicrosoftTeams PowerShell module not found. Please install it first.\" -ForegroundColor Red
    exit
}

try {
    Connect-MicrosoftTeams -ErrorAction Stop
}
catch {
    Write-Host \"[!] Failed to connect to Microsoft Teams. Ensure you have Global Admin rights.\" -ForegroundColor Red
    exit
}

# Get Current Federation Configuration
$fedConfig = Get-CsTenantFederationConfiguration

Write-Host \"[+] Current Federation Configuration:\" -ForegroundColor Yellow
Write-Host \"    AllowFederatedUsers: $($fedConfig.AllowFederatedUsers)\"
Write-Host \"    AllowedDomains: $($fedConfig.AllowedDomains -join ', ')\"

# Recommended Hardening: Block all domains except specific allowed list
# NOTE: This requires updating your specific allow-list before running.

$hardenedDomains = @{
    \"AllowFederatedUsers\" = $false;
    \"AllowedDomains\" = @{\"Allow\" = @(\"contoso.com\", \"trustedpartner.com\")}; # UPDATE THIS LIST
    \"BlockedDomains\" = @{\"Block\" = @()}
}

Write-Host \"\"
Write-Host \"[!] SECURITY RECOMMENDATION:\" -ForegroundColor Magenta
Write-Host \"    Configure 'Teams Meeting Policy' to block anonymous users and 'External Access Policy' to only allow specific domains.\"
Write-Host \"    Run: Set-CsExternalAccessPolicy -EnableFederationAccess $true -EnablePublicCloudAccess $false -AllowFederatedUsers $false\"
Write-Host \"    Then run: Set-CsTenantFederationConfiguration -AllowedDomains @{Allow='allowed.com'}\"

Disconnect-MicrosoftTeams
Write-Host \"[+] Audit complete.\" -ForegroundColor Green