Security teams must immediately shift focus to the collaboration layer. Microsoft has issued a warning confirming that threat actors are increasingly abusing external Microsoft Teams functionality to conduct helpdesk impersonation attacks. Unlike traditional phishing vectors that target email, these attacks arrive directly within the trusted Teams interface, bypassing standard email gateway defenses.
The premise is simple but devastatingly effective: attackers message targets from external Teams tenants masquerading as "IT Support" or "Help Desk." By leveraging the inherent trust users place in internal collaboration tools, actors facilitate social engineering attacks aimed at credential theft, multi-factor authentication (MFA) fatigue, and the deployment of malware via legitimate remote management tools. Defenders must treat the Teams client as a critical attack surface.
Technical Analysis
Affected Products:
- Microsoft Teams (All Desktop/Web Clients)
- Microsoft Entra ID (formerly Azure AD) - Identity Federation
The Attack Vector: This is not a vulnerability in the traditional sense (no CVE), but rather an abuse of configuration and trust. The attack chain typically follows this pattern:
- Initial Access (Social Engineering): An attacker creates a malicious or compromised external Microsoft 365 tenant. They discover target user emails via OSINT or previous breaches.
- External Invitation: The attacker sends a Teams chat request to the target. If the organization allows external communication by default, the notification pops up in the user's Teams client alongside internal corporate messages.
- Impersonation: The attacker claims to be from the internal IT department, stating the user's account is locked or compromised. They provide a "legitimate" link to a fake credential portal or attempt to guide the user through installing remote access software (e.g., Quick Assist, AnyDesk) under the guise of "troubleshooting."
- Lateral Movement/Exfiltration: Once credentials are harvested or remote access is granted, the attacker moves laterally using the compromised user's session token or established remote tooling.
Exploitation Status:
- Status: Confirmed Active Exploitation.
- Source: Microsoft Threat Intelligence reports a marked increase in this technique, often linked to initial access brokers selling compromised network access.
Detection & Response
Detecting this requires visibility into O365 Audit Logs and Identity sign-ins, as the traffic itself is encrypted Teams traffic (UDP/TCP 443) that is indistinguishable from normal collaboration flow on the network layer.
SIGMA Rules
---
title: Potential External Teams Helpdesk Impersonation
id: 8a2f1c30-5e9d-4b10-a123-45d6e78f90a1
status: experimental
description: Detects external users inviting or messaging internal users frequently, characteristic of helpdesk impersonation campaigns.
references:
- https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/analyze-external-teams-traffic?view=o365-worldwide
author: Security Arsenal
date: 2024/05/23
tags:
- attack.initial_access
- attack.social_engineering
- attack.t1566
logsource:
product: o365
service: teams
detection:
selection:
Operation|contains:
- 'MemberAdded'
- 'TeamsSessionStarted'
InitiatorUserType: 'External'
filter_legit_partners:
InitiatorFromDomain|endswith:
- '@known-partner-domain.com'
condition: selection and not filter_legit_partners
falsepositives:
- Legitimate collaboration with external vendors or partners
level: medium
---
title: Teams External Access Policy Modification
id: 9b4e2d41-6f0a-5c21-b234-56e7f89a01b2
status: experimental
description: Detects modifications to Teams Federation or Guest Access settings which may be altered to facilitate or enable attacks.
references:
- https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2024/05/23
tags:
- attack.persistence
- attack.defense_evasion
- attack.t1098
logsource:
product: o365
service: exchange
detection:
selection:
Operation|contains:
- 'Set-OrganizationConfig'
- 'Set-CsTenantFederationConfiguration'
ModifiedProperties:
Name|contains:
- 'AllowFederatedUsers'
- 'AllowGuestAccess'
- 'OpenAuthServer'
condition: selection
falsepositives:
- Authorized administrative changes to collaboration policy
level: high
KQL (Microsoft Sentinel)
// Hunt for External Users initiating Teams conversations or adding members
OfficeActivity
| where Workload == "MicrosoftTeams"
| where Operation in ("MemberAdded", "TeamsSessionStarted", "TabAdded")
| extend InitiatorType = column_ifexists("InitiatorUserType", "")
| where InitiatorType == "External"
| project TimeGenerated, Operation, UserId, Actor = UserId, InitiatorFromDomain, ClientIP, AdditionalDetails
| order by TimeGenerated desc
// Correlate Teams Activity with Failed Logins (Potential credential theft attempt)
let TeamsExternal = OfficeActivity
| where Workload == "MicrosoftTeams"
| where Operation == "TeamsSessionStarted"
| where UserId has "@" // Basic validation
| summarize TeamsStartTime = arg_max(TimeGenerated, *) by UserId, ClientIP;
SigninLogs
| where ResultType != 0
| where ResultDescription in ("AADSTS50126", "AADSTS50053") // Invalid credentials or account locked
| join kind=inner (TeamsExternal) on UserId, IPAddress
| project TimeGenerated, UserId, UserPrincipalName, AppDisplayName, ClientIPAddress, Status = ResultDescription, TeamsStartTime
| order by TimeGenerated desc
Velociraptor VQL
Since the traffic is encrypted, we hunt for the secondary payloads often used in these scams: remote management tools spawned during the "helpdesk" session.
-- Hunt for suspicious remote management tools often used in support scams
-- spawning from common system directories or launched via command line
SELECT Pid, Name, Exe, CommandLine, Username, ParentPid
FROM pslist()
WHERE Name IN ('AnyDesk.exe', 'QuickAssist.exe', 'TeamViewer.exe', 'supremo.exe', 'ScreenConnect.exe', 'connectwise.exe')
AND Exe NOT IN ('C:\\Windows\\System32\\quickassist.exe')
AND Exe NOT LIKE '%Program Files%'
AND Exe NOT LIKE '%Program Files (x86)%'
Remediation Script (PowerShell)
Use this script to audit and restrict external access settings in Microsoft Teams to mitigate the attack surface.
# Requires MicrosoftTeams PowerShell Module
# Install-Module -Name MicrosoftTeams
Import-Module MicrosoftTeams
# Connect to Teams
Connect-MicrosoftTeams
# Function to check and harden Federation settings
function Lock-DownTeamsAccess {
Write-Host "Auditing Current Teams Federation Configuration..." -ForegroundColor Cyan
$config = Get-CsTenantFederationConfiguration
if ($config.AllowFederatedUsers -eq $true) {
Write-Host "[WARNING] Federated Users are ALLOWED." -ForegroundColor Yellow
Write-Host "Action: Setting AllowFederatedUsers to False to block external teams." -ForegroundColor Red
# Comment out the line below to report-only / audit mode
Set-CsTenantFederationConfiguration -AllowFederatedUsers $false
} else {
Write-Host "[INFO] Federated Users are currently BLOCKED. Good." -ForegroundColor Green
}
# Check Guest Access
$guestConfig = Get-CsTeamsGuestMessagingConfiguration
# Note: This is simplified; actual guest access is controlled via Azure AD B2B as well
Write-Host "Please review Azure AD B2B Collaboration settings: https://portal.azure.com/#blade/Microsoft_AAD_IAM/GroupsMenuBlade/ExternalIdentities"
}
# Execute
Lock-DownTeamsAccess
Remediation
1. Restrict External Communication: Microsoft Teams allows external federation by default. This is the primary vector.
- Action: Navigate to the Teams Admin Center > Users > External access.
- Configuration: Set "Let Teams users communicate with Skype users" and "Let Teams users communicate with external Teams users" to Off if business requirements permit. If not, use "Allow only specific external domains" to create an explicit allow-list of trusted partners.
2. Block Guest Invitations:
- Action: In the Microsoft Entra Admin Center (formerly Azure AD), go to Users > User settings.
- Configuration: Set "Guest invite restrictions" to "Only assign admins who can invite guest users" or block guest invitations entirely for specific groups containing sensitive users.
3. User Awareness Training:
- Immediate advisory to all staff: "IT Support will never ask for your password, MFA code, or request you to install remote software via an unsolicited Teams chat."
4. Conditional Access Policies:
- Implement Conditional Access policies that require compliant devices or trusted locations for accessing Teams, making it harder for attackers using compromised credentials from unknown locations to utilize the chat function effectively.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.