Possible partner impersonation in external Team messages

Description

This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message

Query · kql

//This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message
 MessageEvents 
 | where IsOwnedThread==0 and IsExternalThread==1 and SenderDisplayName contains "@contoso.com"
Raw source Possible partner impersonation in external Team messages · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 39cf1ec6-d460-4760-8a87-7d10577f6205
name:  Possible partner impersonation in external Team messages
description: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message
description-detailed: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
 //This query can be used as a Custom Detection Rule (CDR) to trigger when a partner email domain or email address is used in a Sender display name part of an inbound external Teams message
  MessageEvents 
  | where IsOwnedThread==0 and IsExternalThread==1 and SenderDisplayName contains "@contoso.com"
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.