Fabian Bader

NO-BREAK SPACE unicode characters in the display name are not something your average M365 users use.

So better look into #Teams chat messages from those users.

#SecurityTip #KQL

https://github.com/f-bader/AzSentinelQueries/blob/master/Defender%20XDR/SuspiciousTeamsMessagesBasedOnUnicodeInDisplayName.md

AzSentinelQueries/Defender XDR/SuspiciousTeamsMessagesBasedOnUnicodeInDisplayName.md at master · f-bader/AzSentinelQueries

Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources. - f-bader/AzSentinelQueries

GitHub
Dec 20, 2024 at 6:46pmWeb