URL click on URLs in ZAP-d Teams messages

Description

This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP.

Query · kql

//URL click on URLs in ZAP-d Teams messages
MessagePostDeliveryEvents
| join MessageUrlInfo on TeamsMessageId
| join UrlClickEvents on Url
| where ActionType !=""
Raw source URL click on URLs in ZAP-d Teams messages · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 4741e46e-1bdd-453a-90a8-13302a352a73
name: URL click on URLs in ZAP-d Teams messages
description: |
  This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP.
description-detailed: |
  This query visualizes URL clicks on URLs in Teams messages which were acted by ZAP.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - UrlClickEvents
  - MessagePostDeliveryEvents
  - MessageUrlInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //URL click on URLs in ZAP-d Teams messages
  MessagePostDeliveryEvents
  | join MessageUrlInfo on TeamsMessageId
  | join UrlClickEvents on Url
  | where ActionType !=""
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.