Purpose: Rapid response to external callers impersonating IT Support or Corporate staff via Microsoft Teams.


Capture Basic Details 


Collect the following from the user:

  • User name

  • Time of call

  • Caller display name

  • Caller domain (if visible)

  • Screenshot of the Teams call notification (if possible)


Ask the user:

  • Did you share your password?

  • Did you approve an MFA request?

  • Did you install any software?

  • Did you allow remote access?


Create Freshservice ticket



Immediate Risk Assessment


If user DID NOT interact


Document incident
Capture screenshot/logs
Escalate to IT Operations


If user DID interact


Treat as High Severity Security Incident


Immediately:

  • Reset password

  • Revoke active sessions

  • Force MFA reauthentication

Check the User’s Computer


Verify the following are NOT installed or running:

  • Quick Assist

  • AnyDesk

  • TeamViewer

  • ScreenConnect

  • Remote Desktop sessions initiated during call


If found:


➡ Escalate to – High Priority


Check Identity Activity


Review Entra ID sign-in logs


Look for:

  • suspicious logins

  • unfamiliar IP addresses

  • MFA prompts

  • impossible travel alerts

Gather Teams Evidence


Teams Admin Center → Users → Call History


Capture:

  • Caller display name

  • Caller domain/tenant

  • Time of calls

  • Number of users contacted


Attach evidence to ticket.

Notify IT Security / SOC


Report incident to:


Arctiq Google SecOps - [email protected]


Include:

  • Time of call

  • Caller name/domain

  • Impacted users

  • Confirmation if credentials were shared

User Guidance


Advise the user:

  • Do not accept calls from unknown external users

  • Do not share passwords or MFA codes

  • Do not install software requested by callers

Close or Escalate


Close if


✔ No credentials shared
✔ No software installed
✔ No suspicious sign-ins


Escalate if


✔ Credentials exposed
✔ MFA approved
✔ Remote access installed
✔ Suspicious sign-ins detected

Important rule for Helpdesk


If the caller asked the user to install remote access software, treat the incident as High Severity immediately.


Most attackers using Teams try to move the conversation to Quick Assist within 2–3 minutes. Catching this early prevents the majority of compromises.