Teams communication to suspicious external users

id: 389ead4a-6dfe-47e1-9236-165eb08f1017
name: Teams communication to suspicious external users
description: |
  This query helps hunt for communication with suspicious external users.
description-detailed: |
  This query helps hunt for Teams users communicating with suspicious external users using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query uses MessageEvents to detect bi-directional outbound communication to suspicious external Help Desk\Support representatives
  MessageEvents 
  | where Timestamp > ago(30d) 
  | where (RecipientDetails contains "help" and RecipientDetails contains "desk") 
    or (RecipientDetails contains "it" and RecipientDetails contains "support") 
    or (RecipientDetails contains "working" and RecipientDetails contains "home") 
  | where IsExternalThread == true 
  | project Timestamp, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType
version: 1.0.0