Teams users clicking on suspicious URL domains

Description

This query helps hunt for Teams users clicking on suspicious URL domains.

Query · kql

//This Query uses MessageUrlInfo, MessageEvents and UrlClickEvents to find external Teams messages with low reputation URL doamins (.xyz) and identify the top 10 users clicking on them. 
MessageUrlInfo
| extend Domain = extract(@"^(?:https?://)?([^/]+)", 1, Url)
| extend TLD = tostring(split(Domain, ".")[-1])
| where TLD has_any ("dev","app","zip","solutions","io","top")
| join MessageEvents on TeamsMessageId
| join UrlClickEvents on Url
| project Timestamp,Url,UrlDomain,TLD,TeamsMessageId, ReportId, Timestamp2,ActionType,AccountUpn,Workload, SenderDisplayName, SenderEmailAddress, ThreatTypes, DetectionMethods, RecipientDetails
Raw source Teams users clicking on suspicious URL domains · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 0d70619d-b6a5-4958-8721-3f4001dc0472
name: Teams users clicking on suspicious URL domains
description: |
  This query helps hunt for Teams users clicking on suspicious URL domains.
description-detailed: |
  This query helps hunt for Teams users clicking on suspicious URL domains using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
  - MessageEvents
  - MessageUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This Query uses MessageUrlInfo, MessageEvents and UrlClickEvents to find external Teams messages with low reputation URL doamins (.xyz) and identify the top 10 users clicking on them. 
  MessageUrlInfo
  | extend Domain = extract(@"^(?:https?://)?([^/]+)", 1, Url)
  | extend TLD = tostring(split(Domain, ".")[-1])
  | where TLD has_any ("dev","app","zip","solutions","io","top")
  | join MessageEvents on TeamsMessageId
  | join UrlClickEvents on Url
  | project Timestamp,Url,UrlDomain,TLD,TeamsMessageId, ReportId, Timestamp2,ActionType,AccountUpn,Workload, SenderDisplayName, SenderEmailAddress, ThreatTypes, DetectionMethods, RecipientDetails
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.