Display Name - Helpdesk theme impersonation attack detection

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging Microsoft Teams to execute helpdesk-themed phishing campaigns that impersonate trusted internal domains via T1566 (Phishing). Proactive hunting in Azure Sentinel is essential to identify these external UPN anomalies early, preventing credential compromise before attackers can pivot into the broader network.

KQL Query

let HelpdeskDomain = dynamic(["helpdesk-quick.com","helpdesk-call.com","helpdesk-service.com"]);
CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType == "TeamsImpersonationDetected"
| extend ImpersonationDisplayName = tostring(parse_json(tostring(RawEventData.Sender)).DisplayName)
| extend ImpersonationUPN = tostring(parse_json(tostring(RawEventData.Sender)).UPN)
| extend ImpactedUserUPN = tostring(RawEventData.UserId)
| where ImpersonationUPN has_any(HelpdeskDomain)
| project Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN

Analytic Rule Definition

id: edd48210-532e-4560-a8fe-065240cd2f20
name: Display Name - Helpdesk theme impersonation attack detection
description: |
  This query check the external Teams UPN against known Teams impersonation domain
description-detailed: |
  This query check the external Teams UPN against known Teams impersonation domain
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let HelpdeskDomain = dynamic(["helpdesk-quick.com","helpdesk-call.com","helpdesk-service.com"]);
  CloudAppEvents
  | where Timestamp > ago(30d)
  | where ActionType == "TeamsImpersonationDetected"
  | extend ImpersonationDisplayName = tostring(parse_json(tostring(RawEventData.Sender)).DisplayName)
  | extend ImpersonationUPN = tostring(parse_json(tostring(RawEventData.Sender)).UPN)
  | extend ImpactedUserUPN = tostring(RawEventData.UserId)
  | where ImpersonationUPN has_any(HelpdeskDomain)
  | project Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN
version: 1.0.0

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spoof and Impersonation/Helpdesk theme impersonation attack detection.yaml)

False Positive Guidance

Here are 4 specific false positive scenarios for the Helpdesk theme impersonation attack detection rule, including tailored filters and exclusions:

• Scenario: Scheduled Third-Party Backup Service Authentication

  • Context: An enterprise backup solution (e.g., Veeam or Rubrik) runs a nightly scheduled job that authenticates to Microsoft Teams via a service account ([email protected]) using an external UPN to sync audit logs. The rule flags this as impersonation because the source domain differs from the primary helpdesk theme.
  • Suggested Filter/Exclusion: Add a filter to exclude traffic where SourceApplication equals “Veeam Backup & Replication” and AccountType is “Service Account”. Alternatively, whitelist the specific service account UPN in the exclusion list: [email protected].

• Scenario: External Helpdesk Vendor Integration via API

  • Context: The organization uses an external ticketing system (e.g., Jira Service Management or ServiceNow) integrated with Teams. When a high-priority incident is created, the integration bot ([email protected]) pushes notifications to the internal Helpdesk channel using an external UPN that mimics the helpdesk theme structure.
  • Suggested Filter/Exclusion: Exclude events where SourceIP falls within the trusted CIDR block of the vendor’s data center (e.g., 203.0.113.0/24) and the UserPrincipalName contains the substring “jira-integration”.

• Scenario: Cross-Tenant Collaboration for Merged Entities

  • Context: Following a recent merger, employees from an acquired subsidiary (using domain subsidiary-corp.com) are granted guest access to the main tenant. When these