Teams messages with suspicious URL domains

id: 3dc84945-5805-4807-80ea-b849d1198e7f
name: Teams messages with suspicious URL domains
description: |
  This query helps hunt for Teams messages with suspicious URL domains. 
description-detailed: |
  This query helps hunt for Teams messages with suspicious URL domains using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This Query uses MessageUrlInfo to find external Teams messages with suspicious low reputation URL doamins (e.g .xyz etc)
  MessageUrlInfo
  | extend Domain = extract(@"^(?:https?://)?([^/]+)", 1, Url)
  | extend TLD = tostring(split(Domain, ".")[-1])
  | where TLD has_any ("dev","app","zip","solutions","io","top","xyz")
  | project Timestamp,Url,UrlDomain,TLD,TeamsMessageId, ReportId
version: 1.0.0