Microsoft Teams chat initiated by a suspicious external user

id: 8b88ecaf-88b3-4d70-814f-a55b96748ff5
name: Microsoft Teams chat initiated by a suspicious external user
description: |
  Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages.
description-detailed: |
  This query uses AlertInfo and AlertEvidence tables to collect general information and clickable links to more IOCs about suspicious external Teams messages.
  Shared by Microsoft Threat Intelligence:https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/protection-against-multi-modal-attacks-with-microsoft-defender/4438786
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external  Teams messages
  AlertInfo 
  | where Timestamp >= ago(30d) 
  | where Title == "Microsoft Teams chat initiated by a suspicious external user" 
  | join AlertEvidence on AlertId
  | top 100 by Timestamp
version: 1.0.0