New Hunting Query: Teams Helpdesk-Theme Impersonation Detection via Known Suspicious Domains

What Changed

A new hunting query has been added targeting helpdesk-themed Microsoft Teams impersonation attacks. The query operates on the CloudAppEvents table (Microsoft 365 Defender data source via the MicrosoftThreatProtection connector).

Detection Logic

• Primary data source: CloudAppEvents
• Core logic: Filters events where ActionType == “TeamsImpersonationDetected”, extracts the external sender’s DisplayName and UPN from RawEventData.Sender, and matches the UPN against a static hardcoded domain list: helpdesk-quick.com, helpdesk-call.com, helpdesk-service.com.
• Lookback window: 30 days
• Projected fields: Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN
• Entity types mapped: User (impacted UPN, impersonating UPN)

Operational note: The domain list (HelpdeskDomain) is a static dynamic() literal – it requires manual editing to add newly observed impersonation infrastructure. Teams environments not ingesting CloudAppEvents from Microsoft 365 Defender will have no coverage.

MITRE Mapping

Affected Files

Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spoof and Impersonation/Helpdesk theme impersonation attack detection.yaml