Revised YAML based on validation error checks.

Author: SlimKQL

Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spoof and Impersonation/Helpdesk theme impersonation attack detection.yaml

@@ -1,5 +1,5 @@
 id: edd48210-532e-4560-a8fe-065240cd2f20
-name: Helpdesk theme impersonation attack detection
+name: Display Name - Helpdesk theme impersonation attack detection
 description: |
   This query check the external Teams UPN against known Teams impersonation domain
 description-detailed: |
@@ -9,17 +9,17 @@ requiredDataConnectors:
   dataTypes:
   - CloudAppEvents
 tactics:
-  - Social Engineering
+  - InitialAccess
 relevantTechniques:
-  - T1684
+  - T1566
 query: |
-let HelpdeskDomain = dynamic(["helpdesk-quick.com","helpdesk-call.com","helpdesk-service.com"]);
-CloudAppEvents
-| where Timestamp > ago(30d)
-| where ActionType == "TeamsImpersonationDetected"
-| extend ImpersonationDisplayName = tostring(parse_json(tostring(RawEventData.Sender)).DisplayName)
-| extend ImpersonationUPN = tostring(parse_json(tostring(RawEventData.Sender)).UPN)
-| extend ImpactedUserUPN = tostring(RawEventData.UserId)
-| where ImpersonationUPN has_any(HelpdeskDomain)
-| project Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN
+  let HelpdeskDomain = dynamic(["helpdesk-quick.com","helpdesk-call.com","helpdesk-service.com"]);
+  CloudAppEvents
+  | where Timestamp > ago(30d)
+  | where ActionType == "TeamsImpersonationDetected"
+  | extend ImpersonationDisplayName = tostring(parse_json(tostring(RawEventData.Sender)).DisplayName)
+  | extend ImpersonationUPN = tostring(parse_json(tostring(RawEventData.Sender)).UPN)
+  | extend ImpactedUserUPN = tostring(RawEventData.UserId)
+  | where ImpersonationUPN has_any(HelpdeskDomain)
+  | project Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN
 version: 1.0.0