Top 10 External senders sending Teams phishing messsages

Description

This query looking for top 10 External senders sending Team phishing messsages.

Query · kql

//This query looking for top 10 External senders sending Team phishing messsages
 MessageEvents
 | where IsOwnedThread==0 and IsExternalThread==1
 | where ThreatTypes has "Phish"
 | summarize Count = count() by SenderEmailAddress
 | top 10 by Count
Raw source Top 10 External senders sending Teams phishing messsages · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9432f895-763d-4e9b-b9bf-680296ce6c0d
name:  Top 10 External senders sending Teams phishing messsages
description: |
  This query looking for top 10 External senders sending Team phishing messsages.
description-detailed: |
  This query looking for top 10 External senders sending Team phishing messsages.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
 //This query looking for top 10 External senders sending Team phishing messsages
  MessageEvents
  | where IsOwnedThread==0 and IsExternalThread==1
  | where ThreatTypes has "Phish"
  | summarize Count = count() by SenderEmailAddress
  | top 10 by Count
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.