Hunt for malicious messages using External Threat Intelligence

id: 4dcb872f-9b39-4b95-8f30-3664f9f70dc2
name: Hunt for malicious messages using External Threat Intelligence
description: |
  This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source
description-detailed: |
  This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageUrlInfo
  - MessageEvents
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // This query helps hunt for Teams messages with malicious URLs based on external IOC source
  let url = (externaldata(url: string )
  [@"https://urlhaus.abuse.ch/downloads/text_online/"]
  with (format="txt"))
  | project url;
  url
  | join (MessageUrlInfo
  | where Timestamp > ago(14d) 
  ) on $left.url == $right.Url
  |join MessageEvents on TeamsMessageId
  //|join UrlClickEvents on Url
  |project Timestamp, TeamsMessageId, Url, UrlDomain, SenderEmailAddress, SenderDisplayName, RecipientDetails,ThreatTypes, DetectionMethods, DeliveryAction,IsExternalThread, IsOwnedThread//, AccountUpn, ActionType, AppName, AppVersion, Workload
version: 1.0.0