Expanding recipients into separate rows

Description

This query helps hunt for recipients of Teams messages.

Query · kql

//Analyzing recipient details with a separate row for each recipient
MessageEvents
| mv-expand Recipients = RecipientDetails
| extend RecipientSmtpAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType
Raw source Expanding recipients into separate rows · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 70ba5995-866f-4a23-bacc-40b82056893b
name: Expanding recipients into separate rows
description: |
  This query helps hunt for recipients of Teams messages.
description-detailed: |
  This query helps hunt for recipients of Teams messages by expanding the recipient details into separate rows, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Analyzing recipient details with a separate row for each recipient
  MessageEvents
  | mv-expand Recipients = RecipientDetails
  | extend RecipientSmtpAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.