Display Name - Helpdesk theme impersonation attack detection

Description

This query check the external Teams UPN against known Teams impersonation domain

Query · kql

let HelpdeskDomain = dynamic(["helpdesk-quick.com","helpdesk-call.com","helpdesk-service.com"]);
CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType == "TeamsImpersonationDetected"
| extend ImpersonationDisplayName = tostring(parse_json(tostring(RawEventData.Sender)).DisplayName)
| extend ImpersonationUPN = tostring(parse_json(tostring(RawEventData.Sender)).UPN)
| extend ImpactedUserUPN = tostring(RawEventData.UserId)
| where ImpersonationUPN has_any(HelpdeskDomain)
| project Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN
Raw source Display Name - Helpdesk theme impersonation attack detection · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: edd48210-532e-4560-a8fe-065240cd2f20
name: Display Name - Helpdesk theme impersonation attack detection
description: |
  This query check the external Teams UPN against known Teams impersonation domain
description-detailed: |
  This query check the external Teams UPN against known Teams impersonation domain
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let HelpdeskDomain = dynamic(["helpdesk-quick.com","helpdesk-call.com","helpdesk-service.com"]);
  CloudAppEvents
  | where Timestamp > ago(30d)
  | where ActionType == "TeamsImpersonationDetected"
  | extend ImpersonationDisplayName = tostring(parse_json(tostring(RawEventData.Sender)).DisplayName)
  | extend ImpersonationUPN = tostring(parse_json(tostring(RawEventData.Sender)).UPN)
  | extend ImpactedUserUPN = tostring(RawEventData.UserId)
  | where ImpersonationUPN has_any(HelpdeskDomain)
  | project Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.