Top 10 senders of Admin Teams message submissions FN

Description

This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages

Query · kql

CloudAppEvents
| where ActionType == "AdminSubmissionSubmitted"
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)
| where SubmissionContentType == "ChatMessage" and SubmissionType in ("2","1")
| summarize count() by P2Sender
| project P2Sender, TeamsMessages = count_
| top 10 by TeamsMessages desc
Raw source Top 10 senders of Admin Teams message submissions FN · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 49071a21-fbb6-472f-932f-5b6ca1a25883
name: Top 10 senders of  Admin Teams message submissions FN
description: |
  This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages
description-detailed: |
 This query visualises Teams messages submitted by admins as false negatives, summarizing the data by top 10 indidvidual senders of those messages
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "AdminSubmissionSubmitted"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),P2Sender=tostring((parse_json(RawEventData)).P2Sender)
  | where SubmissionContentType == "ChatMessage" and SubmissionType in ("2","1")
  | summarize count() by P2Sender
  | project P2Sender, TeamsMessages = count_
  | top 10 by TeamsMessages desc
version: l.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.