Teams message ZAPed with the same URL in Email

Description

This query helps hunt for Teams messages that have been ZAPed with the same URL in Email.

Query · kql

//This query provides insights on Teams messages ZAPed with the same malicious URLs in Email messages
MessagePostDeliveryEvents
| join MessageUrlInfo on TeamsMessageId
| join EmailUrlInfo on Url
| join EmailEvents on NetworkMessageId
Raw source Teams message ZAPed with the same URL in Email · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 5a34a9c3-041b-46bf-b035-bb17e7ff0be6
name: Teams message ZAPed with the same URL in Email
description: |
  This query helps hunt for Teams messages that have been ZAPed with the same URL in Email.
description-detailed: |
  This query helps hunt for Teams messages that have been ZAPed with the same URL in Email, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessagePostDeliveryEvents
  - MessageUrlInfo
  - EmailUrlInfo
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query provides insights on Teams messages ZAPed with the same malicious URLs in Email messages
  MessagePostDeliveryEvents
  | join MessageUrlInfo on TeamsMessageId
  | join EmailUrlInfo on Url
  | join EmailEvents on NetworkMessageId
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.