Teams Visitor Token Request Anomaly
Identifies anomalous requests to Microsoft TURN relays, potentially requesting anonymous visitor tokens. This rule looks for a high volume of network connections to 'turn.teams.microsoft.com' or 'relay.teams.microsoft.com' from processes other than the legitimate Microsoft Teams application, indicating potential abuse of the Teams infrastructure for malicious traffic tunneling.
Microsoft Sentinel (KQL)
