Malicious Teams messages received from external senders

id: ac842e4d-0c7d-4980-b09d-c761f3de0a79
name: Malicious Teams messages received from external senders
description: |
  This query helps hunt for malicious Teams messages received from external senders.
description-detailed: |
  This query helps hunt for Malicious Teams messages received from external senders, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query helps hunt for Teams messages from external senders with Threats (Spam, Phish, Malware)
  MessageEvents 
  | where Timestamp > ago(30d)
  | where IsExternalThread==1 and IsOwnedThread==0
  | where ThreatTypes has_any ("Phish","Malware","Spam")                    
  | project Timestamp,TeamsMessageId, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId, ThreatTypes, DetectionMethods
version: 1.0.0