Top 10 sender domains - Admin Teams message submissions FN

Description

This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages

Query · kql

CloudAppEvents
| where ActionType == "AdminSubmissionSubmitted"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)
| where SubmissionContentType == "ChatMessage" and SubmissionType in ("2","1")
| summarize count() by P2SenderDomain
| project P2SenderDomain, TeamsMessages = count_
| top 10 by TeamsMessages desc
Raw source Top 10 sender domains - Admin Teams message submissions FN · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 132dffdf-3ee0-4748-8509-fbd3a92e5c9f
name: Top 10 sender domains - Admin Teams message submissions FN
description: |
  This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages
description-detailed: |
 This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 sender domains of those messages
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "AdminSubmissionSubmitted"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2SenderDomain=tostring((parse_json(RawEventData)).P2SenderDomain)
  | where SubmissionContentType == "ChatMessage" and SubmissionType in ("2","1")
  | summarize count() by P2SenderDomain
  | project P2SenderDomain, TeamsMessages = count_
  | top 10 by TeamsMessages desc
version: l.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.