Suspicious Teams Display Name

id: 97e1c837-2cef-4f43-a87f-11f16e33ee8d
name: Suspicious Teams Display Name
description: |
  This query looks for Teams messages from an external user with a suspicious display name.
description-detailed: |
  This query looks for Teams messages from an external user with a suspicious display name.
  Threat actors may attempt to socially engineer a user by using display names such as IT Support or Help Desk to establish trust.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let SuspiciousDisplayNames = pack_array("Microsoft  Security", "Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "IT Support", "Helpdesk");
  MessageEvents
  | where IsExternalThread == 1 and IsOwnedThread == 0
  | where SenderDisplayName has_any (SuspiciousDisplayNames)
version: 1.0.0