tag: Microsoft-Teams · 7 items
- Engineer — Plan: Teams’ external-chat feature is being abused at scale; audit your tenant’s external access policy and consider restricting or requiring approval for inbound external chat requests in the Teams admin center.
- SOC/IR — Act: Hundreds of confirmed cases share a pattern of throwaway tenants with IT-themed names initiating chats that precede malware drops; hunt for Teams external-chat sessions from newly created tenants and correlate with unusual child-process creation from Teams.exe since at least early October 2026.
- Leader — Plan: A high-volume campaign is using Teams to impersonate internal IT and deliver ransomware; schedule an employee awareness communication this week and direct the team to review the tenant’s external-communications policy before next quarter.
- Engineer — Skip
- SOC/IR — Plan: New platform-native detection capability arriving in Teams; review what coverage it provides and identify any gaps relative to existing phishing detection rules to avoid duplication or missed telemetry.
- Leader — Plan: Upcoming Teams phishing detection capability is worth noting for your next security controls review — confirm rollout timeline with your M365 tenant and assess whether it affects your current phishing-awareness program scope.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: Microsoft building deepfake-detection APIs into Teams signals that AI-enabled impersonation in business video calls is maturing as an enterprise threat vector; useful context for updating AI/social-engineering risk language in the next board or policy review cycle.
- Engineer — Plan: Once released, review Teams file-extension block list against your organization’s threat profile and configure it to block high-risk extensions (e.g., .exe, .bat, .ps1) not already covered by defaults.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: No CVE or patch required; the attack path abuses Teams social engineering rather than a software flaw, so review Teams external-access settings and restrict who can initiate calls from outside the tenant.
- SOC/IR — Act: Active enterprise campaign targeting domain controllers via Teams vishing — hunt for anomalous Teams call activity from external tenants followed by process execution or lateral movement, and review Unit 42’s published TTPs for detection rule development.
- Leader — Plan: Campaign targets enterprise domain controllers through a trusted communication channel (Teams), raising both breach-risk and vendor-trust questions — brief IT leadership and consider tightening external Teams communication policies this quarter.
- Engineer — Plan: Enable the Teams meeting protection policy in your tenant admin settings to prevent uninvited external bots from joining meetings — worth configuring this quarter as part of M365 hardening.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: No exploitable software vulnerability here — the attack surface is social engineering over Teams external messages. Review whether your Teams tenant restricts external/guest messaging and confirm phishing-resistant MFA is enforced for all accounts.
- SOC/IR — Plan: Active campaign using Teams external messages to deliver a fake lock screen overlay for credential harvesting; build or tune detections for Teams-sourced phishing followed by unusual lock screen events and credential access patterns in EDR telemetry.
- Leader — Learn: Confirms Microsoft Teams is an active credential-phishing vector, useful context for awareness training priorities, but no corroborating signals or sector-specific targeting reported that would require immediate leadership action.