Top External Sender domains - Spam

id: 96ea02b2-7db7-4206-bd7f-c3c579d33fcc
name: Top External Sender domains - Spam
description: |
  Top External Sender domains sending Teams message with Spam threats
description-detailed: |
  This query helps hunt for Top External Sender domains sending Teams message with Spam threats, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Top External Sender domains sending Teams message with Spam threats
  MessageEvents
  | where IsExternalThread==1 and IsOwnedThread==0
  | where ThreatTypes contains "Spam"
  | extend SenderDomain = tostring(split(SenderEmailAddress, "@")[1])
  | summarize count() by SenderDomain
version: 1.0.0