Teams Phish ZAP

Description

This query helps hunt for Teams messages with Phish threats that have been ZAPed.

Query · kql

//Zero-hour auto purge (ZAP) took action on Teams messages containing Phish after delivery
MessagePostDeliveryEvents
| where ActionType == 'Phish ZAP'
Raw source Teams Phish ZAP · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9d6594d8-1d0b-42c7-9dab-2a2c1db5c330
name: Teams Phish ZAP
description: |
  This query helps hunt for Teams messages with Phish threats that have been ZAPed.
description-detailed: |
  This query helps hunt for Teams messages with Phish threats that have been ZAPed, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessagePostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Zero-hour auto purge (ZAP) took action on Teams messages containing Phish after delivery
  MessagePostDeliveryEvents
  | where ActionType == 'Phish ZAP' 
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.