Detection rules › By catalog entry

M365-MicrosoftTeams

Catalog entry	Rules
MemberAdded	2
MemberRemoved	3
TeamDeleted	1
TeamsTenantSettingChanged	1
ChatCreated	1

MemberAdded

2 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

Anomalous login followed by Teams action severity medium T1078,T1098,T1136,T1199
External user added and removed in short timeframe severity low T1136

MemberRemoved

3 detection rules reference this catalog entry. View catalog entry.

Kusto (2)

Anomalous login followed by Teams action severity medium T1078,T1098,T1136,T1199
External user added and removed in short timeframe severity low T1136

YARA-L (1)

Office 365 Teams member removed severity low

TeamDeleted

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Multiple Teams deleted by a single user severity low T1485,T1489

TeamsTenantSettingChanged

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Teams Custom Application Interaction Enabled severity medium T1484,T1685

ChatCreated

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

M365 Teams Rogue Help Desk Chat Created severity high T1566,T1566.003

Back to all M365-MicrosoftTeams catalog entries