Detection rules › By event

M365-MicrosoftTeams

Event	Rules
MemberAdded	2
MemberRemoved	3
TeamDeleted	1
TeamsTenantSettingChanged	1
ChatCreated	1

MemberAdded

2 detection rules reference this event. View event page.

Kusto (2)

Anomalous login followed by Teams action severity medium T1078, T1098, T1136, T1199
External user added and removed in short timeframe severity low T1136

MemberRemoved

3 detection rules reference this event. View event page.

Kusto (2)

Anomalous login followed by Teams action severity medium T1078, T1098, T1136, T1199
External user added and removed in short timeframe severity low T1136

YARA-L (1)

Office 365 Teams member removed severity low

TeamDeleted

1 detection rules reference this event. View event page.

Kusto (1)

Multiple Teams deleted by a single user severity low T1485, T1489

TeamsTenantSettingChanged

1 detection rules reference this event. View event page.

Elastic (1)

M365 Teams Custom Application Interaction Enabled severity medium T1484, T1685

ChatCreated

1 detection rules reference this event. View event page.

Elastic (1)

M365 Teams Rogue Help Desk Chat Created severity high T1566, T1566.003