Teams Message with URL listed on OpenPhish

id: 0d0a865b-7ed4-4e32-8b57-24cbf6b301b9
name: Teams Message with URL listed on OpenPhish
description: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish was delivered.
description-detailed: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish was delivered.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious Teams message with a URL from OpenPhish.
  let PhishingURLs = externaldata(url: string)
  [
  "https://raw.githubusercontent.com/openphish/public_feed/refs/heads/main/feed.txt"
  ]
  with (format="txt"); // CSV and JSON formats are also valid formats if using the premium feeds
  MessageUrlInfo
   | where Url in (PhishingURLs)
   | join MessageEvents on TeamsMessageId
   //| where IsOwnedThread==0 and IsExternalThread==1
version: 1.0.0