Microsoft Teams IT Support Scams: Detecting and Blocking External Chat Social Engineering Attacks

Introduction

Cybersecurity researchers have identified a persistent and evolving social engineering campaign exploiting Microsoft Teams' external chat functionality. Across hundreds of documented incidents, threat actors are leveraging the platform's legitimate external communication features to impersonate IT support personnel, establish trust with target users, and ultimately deliver malicious software—including ransomware payloads that have led to significant encryption-based incidents.

This is not a vulnerability in Microsoft Teams itself. Rather, attackers are abusing the platform's default federation settings and the inherent trust users place in communications appearing to originate from within their collaboration environment. The pattern is consistent: attackers create throwaway Microsoft 365 tenants with convincing naming conventions, initiate external chats with targets, and use social engineering pretexts—typically urgent IT support scenarios—to trick users into executing malicious code or granting remote access.

For SOC analysts and defenders, this campaign represents a critical detection challenge. The initial access vector bypasses traditional email security controls entirely. Communications appear legitimate within the Teams client. And because the attack leverages native platform functionality, network-level indicators are minimal. This post provides actionable detection content, hunting queries, and hardening guidance to identify and disrupt these attacks before they progress to malware deployment or ransomware encryption.

Technical Analysis

Attack Chain Overview

The observed attack pattern follows a consistent methodology across incidents:

Stage 1: Tenant Creation and Infrastructure Setup Threat actors register disposable Microsoft 365 tenants using naming conventions designed to impersonate legitimate IT support organizations. These tenants are typically short-lived—created shortly before campaigns launch and abandoned quickly after detection. The use of throwaway tenants complicates attribution and evades reputation-based blocking.

Stage 2: External Chat Initiation Attackers leverage Microsoft Teams' external access (federation) feature, which by default allows users to communicate with external Teams users. The attacker initiates a chat request to target users within victim organizations. Because these requests appear within the Teams client—an application users associate with internal, trusted communications—the psychological barrier is significantly lower than with email-based phishing.

Stage 3: Social Engineering and Trust Establishment The attacker adopts an IT support persona, often claiming to address urgent technical issues: expired credentials, required software updates, security incidents requiring immediate remediation, or VPN/connectivity problems. The urgency and authority of the IT support pretext pressures users into compliance.

Stage 4: Payload Delivery or Remote Access Once trust is established, the attacker directs the user to execute malicious actions. Common vectors include:

Directing users to download and execute remote access tools (RATs) disguised as support utilities
Providing links to credential harvesting pages mimicking corporate login portals
Instructing users to run PowerShell commands or scripts presented as diagnostic tools
Delivering malware payloads through file sharing within the Teams chat

Stage 5: Post-Compromise Activity Following initial access, attackers conduct reconnaissance, escalate privileges, establish persistence, and— in the most severe cases—deploy ransomware. The encryption-based incidents referenced in the research indicate successful progression through the full attack lifecycle.

Why This Attack Works

Several factors make this technique particularly effective:

Trust Transference: Users inherently trust communications within Teams more than external email. The platform's association with internal collaboration creates a false sense of security.
Email Security Bypass: The attack never traverses email gateways, rendering traditional phishing detection controls ineffective.
Legitimate Platform Functionality: External chat is a sanctioned, business-critical feature. Blocking it entirely is often impractical for organizations with legitimate external collaboration requirements.
Low Technical Barrier: The attack requires no exploitation of software vulnerabilities—only social engineering proficiency and basic Microsoft 365 tenant setup.

Affected Platforms and Scope

Primary Target: Microsoft Teams (all versions with external access enabled)
Underlying Platform: Microsoft 365 / Entra ID (Azure AD)
Exploitation Requirements: External access (federation) enabled in Teams admin center; user accounts not restricted from external communications

Exploitation Status

This attack pattern is actively exploited in the wild. Security researchers have documented hundreds of incidents, indicating widespread adoption by multiple threat actor groups. The technique has been observed as an initial access vector leading to ransomware deployment, placing it in the highest severity category for defender attention.

Detection & Response

SIGMA Rules

The following Sigma rules target observable behaviors associated with this attack pattern. Rule 1 focuses on suspicious PowerShell execution patterns consistent with social engineering delivery. Rule 2 targets remote access tool installation commonly observed in these campaigns.

YAML

---
title: Suspicious PowerShell Execution via Social Engineering Pretext
id: 8f3a2b91-4c7d-4e8f-9a1b-2d3e4f5a6b7c
status: experimental
description: Detects PowerShell execution with encoded commands or download cradles consistent with Teams-based IT support scams where users are instructed to run malicious commands.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1656/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1656
logsource:
  category: process_creation
  product: windows
detection:
  selection_encoded:
    CommandLine|contains:
      - '-enc '
      - '-encodedcommand '
      - '-ec '
      - 'FromBase64String'
  selection_download:
    CommandLine|contains:
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'curl.exe'
      - 'wget.exe'
      - 'certutil -urlcache'
      - 'bitsadmin /transfer'
  selection_suspicious_paths:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  filter_legitimate:
    CommandLine|contains:
      - 'https://aka.ms/'
      - 'https://go.microsoft.com/'
      - 'https://docs.microsoft.com/'
  condition: (selection_encoded or (selection_download and selection_suspicious_paths)) and not filter_legitimate
falsepositives:
  - Legitimate administrative scripts
  - Software deployment tools
  - IT automation platforms
level: high
---
title: Remote Access Tool Installation Following User Interaction
id: 2b4c6d8e-1a3f-4e5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects installation or execution of remote access tools commonly used in IT support impersonation scams, particularly when initiated by non-admin users or from user-writable directories.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://attack.mitre.org/techniques/T1656/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.t1656
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\screenconnect.exe'
      - '\connectwise.exe'
      - '\splashtop.exe'
      - '\logmein.exe'
      - '\gotomypc.exe'
      - '\chrome_remote_desktop.exe'
      - '\rustdesk.exe'
      - '\ammyy.exe'
      - '\ultraviewer.exe'
      - '\zohoassist.exe'
      - '\dameware.exe'
      - '\bomgar.exe'
      - '\beyondtrust.exe'
  selection_user_paths:
    Image|contains:
      - '\Users\'
      - '\AppData\'
      - '\Downloads\'
      - '\Desktop\'
      - '\Temp\'
  filter_it_deployment:
    ParentImage|endswith:
      - '\sccm\'
      - '\intune\'
      - '\pdqdeploy\'
      - '\chocolatey\'
  condition: selection_tools and selection_user_paths and not filter_it_deployment
falsepositives:
  - Legitimate remote support sessions by IT
  - Approved remote access tools in user directories
level: medium
---
title: Teams Process Spawning Suspicious Child Processes
id: 5e7f9a1b-3c5d-4e6f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects Microsoft Teams spawning command interpreters or script hosts, which may indicate successful social engineering leading to in-process execution or shell spawning.
references:
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Teams.exe'
      - '\msedgewebview2.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\powershell_ise.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Teams plugin behavior
  - IT support tools integrated with Teams
level: high

KQL Queries (Microsoft Sentinel / Defender)

The following KQL queries hunt for indicators associated with Teams-based social engineering attacks across endpoint and identity telemetry.

KQL — Microsoft Sentinel / Defender

// Hunt 1: Suspicious PowerShell execution with download patterns (potential post-social-engineering execution)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("powershell.exe", "powershell_ise.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "FromBase64String", "IEX", "Invoke-Expression", "DownloadString", "DownloadFile", "Invoke-WebRequest", "Invoke-RestMethod")
| where ProcessCommandLine has_any ("http://", "https://")
| where not(ProcessCommandLine has_any ("aka.ms", "go.microsoft.com", "docs.microsoft.com", "microsoft.com/fwlink"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, ParentProcessName, SHA256
| order by TimeGenerated desc

// Hunt 2: Remote access tool execution from user-writable paths
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("anydesk.exe", "teamviewer.exe", "screenconnect.exe", "connectwise.exe", "splashtop.exe", "rustdesk.exe", "ultraviewer.exe", "ammyy.exe", "zohoassist.exe", "logmein.exe", "gotomypc.exe")
| where FolderPath has_any ("\\Users\\", "\\AppData\\", "\\Downloads\\", "\\Desktop\\", "\\Temp\\")
| where InitiatingProcessFileName !in~ ("sccm", "intune", "pdq", "msiexec")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

// Hunt 3: Teams process spawning script interpreters or command shells
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("Teams.exe", "msedgewebview2.exe")
| where FileName in~ ("powershell.exe", "powershell_ise.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe", "wmic.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt 4: External Teams chat creation events (audit log correlation - requires Teams audit log ingestion)
// Note: This query assumes Teams audit logs are ingested into Sentinel via Office 365 connector
OfficeActivity
| where TimeGenerated > ago(7d)
| where OfficeWorkload == "MicrosoftTeams"
| where Operation == "ChatCreated"
| where ExtendedProperties has "External" or ExtendedProperties has "Guest"
| extend ChatType = tostring(parse_json(ExtendedProperties)[0].Value)
| extend Participants = tostring(parse_json(ExtendedProperties)[1].Value)
| project TimeGenerated, UserId, Operation, ChatType, Participants, ClientIP
| order by TimeGenerated desc

// Hunt 5: Multiple external tenant chat attempts (potential campaign identification)
// Identifies users receiving external chat requests from multiple distinct external tenants in short timeframe
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any ("teams.microsoft.com", "teams.live.com")
| where InitiatingProcessFileName =~ "Teams.exe"
| summarize ConnectionCount = dcount(RemoteIP), RemoteIPs = make_set(RemoteIP) by DeviceName, AccountName, bin(TimeGenerated, 1h)
| where ConnectionCount > 10
| order by ConnectionCount desc

Velociraptor VQL

The following VQL artifact hunts for endpoint artifacts associated with Teams social engineering attacks.

VQL — Velociraptor

-- Hunt for suspicious processes spawned from Teams or containing social engineering indicators
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       CASE 
           WHEN CommandLine =~ '(?i)(powershell|cmd|wscript|cscript|mshta).*http' THEN 'DownloadCradle'
           WHEN Name =~ '(?i)(anydesk|teamviewer|screenconnect|rustdesk|ultraviewer|ammyy|splashtop|zoho)' THEN 'RemoteAccessTool'
           WHEN Exe =~ '(?i)\\\\Users\\\\|\\\\AppData\\\\|\\\\Downloads\\\\|\\\\Temp\\\\' THEN 'UserWritablePath'
           ELSE 'Other'
       END AS IndicatorType
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|cmd|wscript|cscript|mshta)'
   OR Name =~ '(?i)(anydesk|teamviewer|screenconnect|connectwise|rustdesk|ultraviewer|ammyy|splashtop|zohoassist|logmein)'
   OR (Exe =~ '(?i)\\\\Users\\\\|\\\\AppData\\\\|\\\\Downloads\\\\|\\\\Temp\\\\' AND Name =~ '(?i)\\.exe$')

VQL — Velociraptor

-- Hunt for persistence mechanisms potentially established post-compromise
SELECT Key.Name AS RegistryKey, Key.ValueName, Key.ValueData, Key.LastWriteTime,
       File.Path AS FilePath, File.Size, File.Mtime AS FileModified
FROM glob(globs='HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*', accessor='reg')
JOIN glob(globs='HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*', accessor='reg') ON 1=1
LEFT JOIN foreach(row={SELECT * FROM glob(globs=Key.ValueData)}) AS File ON 1=1
WHERE Key.ValueData =~ '(?i)(powershell|cmd|wscript|cscript|mshta|rundll32|regsvr32|anydesk|teamviewer|screenconnect|rustdesk)'
   OR Key.ValueData =~ '(?i)\\\\Users\\\\|\\\\AppData\\\\|\\\\Temp\\\\'

VQL — Velociraptor

-- Hunt for network connections to suspicious external tenants or RMM infrastructure
SELECT Pid, ProcessName, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status,
       CASE
           WHEN RemoteAddr =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)' THEN 'RFC1918'
           WHEN RemoteAddr =~ '^169\\.254\\.' THEN 'LinkLocal'
           ELSE 'External'
       END AS NetworkScope
FROM netstat()
WHERE ProcessName =~ '(?i)(teams|powershell|cmd|anydesk|teamviewer|screenconnect|rustdesk)'
   AND Status == 'ESTABLISHED'
   AND RemoteAddr !~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|169\\.254\\.|127\\.)'

Remediation Script

The following PowerShell script audits Teams external access configuration and implements recommended hardening settings.

PowerShell

<#
.SYNOPSIS
    Audit and harden Microsoft Teams external access settings to mitigate IT support impersonation attacks.

.DESCRIPTION
    This script connects to Microsoft Teams PowerShell and audits current external access configuration.
    It then implements recommended hardening settings to restrict external communications while
    preserving business functionality where required.

.NOTES
    Requires: MicrosoftTeams PowerShell module, appropriate admin permissions
    Author: Security Arsenal
    Date: 2026-10-15
#>

# Check for and install required module if not present
if (-not (Get-Module -ListAvailable -Name MicrosoftTeams)) {
    Write-Host "[INFO] Installing MicrosoftTeams PowerShell module..." -ForegroundColor Yellow
    Install-Module -Name MicrosoftTeams -Force -AllowClobber -Scope CurrentUser
}

Import-Module MicrosoftTeams

# Connect to Teams (will prompt for authentication)
Write-Host "[INFO] Connecting to Microsoft Teams..." -ForegroundColor Cyan
Connect-MicrosoftTeams

# Audit current external access configuration
Write-Host "`n[AUDIT] Current Teams External Access Configuration" -ForegroundColor Green
Write-Host "=" * 60 -ForegroundColor Green

$tenantConfig = Get-CsTenantFederationConfiguration

Write-Host "`nAllowFederatedUsers: $($tenantConfig.AllowFederatedUsers)" -ForegroundColor $(if($tenantConfig.AllowFederatedUsers) {"Red"} else {"Green"})
Write-Host "AllowPublicUsers: $($tenantConfig.AllowPublicUsers)" -ForegroundColor $(if($tenantConfig.AllowPublicUsers) {"Red"} else {"Green"})
Write-Host "AllowedDomains: $($tenantConfig.AllowedDomains | Out-String)" -ForegroundColor Yellow
Write-Host "BlockedDomains: $($tenantConfig.BlockedDomains | Out-String)" -ForegroundColor Yellow

# Audit external access policies
Write-Host "`n[AUDIT] External Access Policies" -ForegroundColor Green
Write-Host "=" * 60 -ForegroundColor Green

$externalPolicies = Get-CsExternalAccessPolicy
$externalPolicies | ForEach-Object {
    Write-Host "`nPolicy: $($_.Identity)" -ForegroundColor Cyan
    Write-Host "  EnableFederationAccess: $($_.EnableFederationAccess)" -ForegroundColor $(if($_.EnableFederationAccess) {"Red"} else {"Green"})
    Write-Host "  EnablePublicCloudAccess: $($_.EnablePublicCloudAccess)" -ForegroundColor $(if($_.EnablePublicCloudAccess) {"Red"} else {"Green"})
    Write-Host "  EnableXmppAccess: $($_.EnableXmppAccess)" -ForegroundColor $(if($_.EnableXmppAccess) {"Yellow"} else {"Green"})
}

# Audit user-level external access settings
Write-Host "`n[AUDIT] Sample of Users with External Access Enabled" -ForegroundColor Green
Write-Host "=" * 60 -ForegroundColor Green

$usersWithExternal = Get-CsOnlineUser | Where-Object {$_.ExternalAccessPolicy -ne $null} | Select-Object -First 20
$userCount = (Get-CsOnlineUser | Where-Object {$_.ExternalAccessPolicy -ne $null}).Count

Write-Host "Total users with explicit external access policy: $userCount" -ForegroundColor $(if($userCount -gt 0) {"Yellow"} else {"Green"})
$usersWithExternal | Select-Object UserPrincipalName, ExternalAccessPolicy | Format-Table -AutoSize

# Hardening recommendations
Write-Host "`n[RECOMMENDATIONS] Hardening Options" -ForegroundColor Green
Write-Host "=" * 60 -ForegroundColor Green

Write-Host @"

1. BLOCK ALL EXTERNAL ACCESS (Most Restrictive)
   Set-CsTenantFederationConfiguration -AllowFederatedUsers `$false

2. ALLOW SPECIFIC DOMAINS ONLY (Recommended for most organizations)
   `$allowedDomains = @("partner1.com", "partner2.com")
   Set-CsTenantFederationConfiguration -AllowFederatedUsers `$true -AllowedDomains `$allowedDomains

3. BLOCK SPECIFIC DOMAINS (Less effective - attackers rotate domains)
   `$blockedDomains = @("malicious-tenant.onmicrosoft.com")
   Set-CsTenantFederationConfiguration -BlockedDomains `$blockedDomains

4. RESTRICT EXTERNAL ACCESS PER USER (Granular control)
   # Create restrictive policy
   New-CsExternalAccessPolicy -Identity "RestrictExternalAccess" -EnableFederationAccess `$false -EnablePublicCloudAccess `$false
   # Apply to users
   Grant-CsExternalAccessPolicy -Identity user@domain.com -PolicyName "RestrictExternalAccess"

5. ENABLE TEAMS AUDIT LOGGING AND ALERTING
   # Ensure Office 365 audit logging is enabled
   # Configure alerts for: ChatCreated with external participants, external file sharing

"@ -ForegroundColor White

# Interactive hardening prompt
Write-Host "`n[ACTION] Would you like to apply hardening settings? (Y/N): " -ForegroundColor Yellow -NoNewline
$applyHardening = Read-Host

if ($applyHardening -eq "Y" -or $applyHardening -eq "y") {
    Write-Host "`nSelect hardening option:" -ForegroundColor Cyan
    Write-Host "1. Block all external access (most secure)"
    Write-Host "2. Allow specific domains only"
    Write-Host "3. Skip hardening (audit only)"
    $choice = Read-Host "Enter choice (1-3)"
    
    switch ($choice) {
        "1" {
            Write-Host "[ACTION] Blocking all external Teams access..." -ForegroundColor Red
            Set-CsTenantFederationConfiguration -AllowFederatedUsers $false
            Write-Host "[SUCCESS] External access disabled." -ForegroundColor Green
        }
        "2" {
            $domains = Read-Host "Enter comma-separated allowed domains (e.g., partner.com,vendor.com)"
            $allowedDomains = $domains -split "," | ForEach-Object { $_.Trim() }
            Write-Host "[ACTION] Restricting to allowed domains: $($allowedDomains -join ', ')" -ForegroundColor Yellow
            Set-CsTenantFederationConfiguration -AllowFederatedUsers $true -AllowedDomains $allowedDomains
            Write-Host "[SUCCESS] External access restricted to specified domains." -ForegroundColor Green
        }
        "3" {
            Write-Host "[INFO] Skipping hardening. Audit complete." -ForegroundColor Yellow
        }
        default {
            Write-Host "[WARNING] Invalid selection. No changes applied." -ForegroundColor Red
        }
    }
}

# Generate audit report
Write-Host "`n[REPORT] Generating configuration report..." -ForegroundColor Cyan
$reportPath = ".\TeamsExternalAccessAudit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"

$tenantConfig | Select-Object @{N="Setting";E={"AllowFederatedUsers"}}, @{N="Value";E={$_.AllowFederatedUsers}} | Export-Csv -Path $reportPath -NoTypeInformation
$tenantConfig | Select-Object @{N="Setting";E={"AllowPublicUsers"}}, @{N="Value";E={$_.AllowPublicUsers}} | Export-Csv -Path $reportPath -NoTypeInformation -Append

Write-Host "[SUCCESS] Report saved to: $reportPath" -ForegroundColor Green

Write-Host "`n[COMPLETE] Teams External Access Audit and Hardening Complete" -ForegroundColor Green

Remediation

Immediate Actions

1. Audit Current External Access Configuration Use the provided PowerShell script to inventory current Teams federation settings. Identify whether external access is enabled, which domains are allowed or blocked, and which users have explicit external access policies applied.

2. Implement Domain-Based Restrictions If external collaboration is business-required, configure explicit domain allowlists rather than permitting open federation. Work with business stakeholders to identify legitimate partner domains and restrict all others.

3. Enable and Monitor Teams Audit Logging Ensure Office 365 audit logging is enabled and ingested into your SIEM. Configure alerts for:

ChatCreated events with external participants
External file sharing in Teams
Guest user additions to teams/channels
External meeting join attempts

4. Deploy Detection Content Implement the Sigma rules, KQL queries, and VQL artifacts provided in this post. Tune thresholds based on your environment's baseline for PowerShell usage, remote access tools, and Teams process behavior.

Strategic Hardening

5. User Awareness Training Conduct targeted training on Teams-based social engineering. Emphasize that:

Legitimate IT support will never initiate contact via external Teams chat requesting credential entry or software installation
Users should verify IT support requests through established internal channels (help desk ticket, known phone number)
Urgency and authority are common social engineering pressure tactics

6. Establish Verification Protocols Implement and communicate a formal verification process for any external IT support contact:

Require callback to known internal help desk number before taking any action
Never execute commands or install software based solely on chat instructions
Verify sender identity through out-of-band channels

7. Technical Controls

Deploy attack surface reduction (ASR) rules to block Office child process execution where appropriate
Implement application control (WDAC/AppLocker) to restrict unauthorized remote access tools
Configure PowerShell logging (Script Block Logging, Module Logging) and forward to SIEM
Consider implementing Teams chat policies restricting external communication for high-risk user groups

8. Incident Response Preparedness

SQL

Update IR playbooks to include Teams social engineering scenarios. Ensure responders understand:

How to collect Teams audit logs and chat transcripts (with appropriate legal/HR coordination)
Indicators of compromise specific to this attack pattern
Containment steps including external access restriction and user session revocation

Vendor Resources and References

Microsoft Teams External Access Documentation: https://learn.microsoft.com/en-us/microsoftteams/communicate-with-users-from-other-organizations
Microsoft Teams PowerShell Module: https://learn.microsoft.com/en-us/powershell/module/teams/
Office 365 Management Activity API: https://learn.microsoft.com/en-us/office/office-365-management-api/
CISA Phishing Guidance: https://www.cisa.gov/phishing

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub

Microsoft Teams IT Support Scams: Detecting and Blocking External Chat Social Engineering Attacks

Introduction

Technical Analysis

Attack Chain Overview

Why This Attack Works

Affected Platforms and Scope

Exploitation Status

Detection & Response

SIGMA Rules

KQL Queries (Microsoft Sentinel / Defender)

Velociraptor VQL

Remediation Script

Remediation

Immediate Actions

Strategic Hardening

Vendor Resources and References

Related Resources

Is your security operations ready?