DragonForce - Backdoor.Turn: Suspicious Teams Process Network Connections
Detects Microsoft Teams processes (teams.exe or ms-teams.exe) making multiple network connections to domains or IP addresses that are not part of the expected Microsoft Teams infrastructure. This rule specifically looks for connections to non-Microsoft domains (excluding .microsoft.com, .office.com, .office365.com, .skype.com, .azure.com, .cdn.office.net) and non-private IP addresses, indicating potential C2 activity by the Backdoor.Turn malware.
Microsoft Sentinel (KQL)
