Top External malicious Senders

id: 164a77d1-3952-451f-ba30-b4a43804fd8a
name: Top External malicious Senders
description: |
  Top external senders sending malicious inbound Teams messages Spam, Phish, Malware
description-detailed: |
  This query helps hunt for top external senders sending malicious inbound Teams messages Spam, Phish, Malware, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Top external senders sending malicious inbound Teams messages Spam, Phish, Malware
  MessageEvents 
  | where IsOwnedThread==0 and IsExternalThread==1 and ThreatTypes !='' and Timestamp > ago(30d)
  | summarize count() by SenderEmailAddress, ThreatTypes 
  | sort by count_ desc
version: 1.0.0