Teams communication from suspicious external users

id: 1fbd2430-2dfe-421a-82b3-eabec5a0b38e
name: Teams communication from suspicious external users
description: |
  This query helps hunt for communication from suspicious external users.
description-detailed: |
  This query helps hunt for Teams communication from suspicious external users using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query uses MessageEvents to detect communication from suspicious external Help Desk\Support representatives
  MessageEvents 
  | where Timestamp > ago(30d) 
  | where (SenderDisplayName contains "help" and SenderDisplayName contains "desk") 
    or (SenderDisplayName contains "it" and SenderDisplayName contains "support") 
    or (SenderDisplayName contains "working" and SenderDisplayName contains "home") 
  | where IsExternalThread == true 
  | project Timestamp, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType
version: 1.0.0