External malicious Teams messages sent from internal senders

id: aee866e2-dc92-4563-a387-b9e5710246c0
name: External malicious Teams messages sent from internal senders
description: |
  This query helps hunt for external malicious Teams messages sent from internal senders
description-detailed: |
  This query helps hunt for external malicious Teams messages sent from internal senders, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query helps hunt for Teams messages from internal senders with Threats in them (Spam, Phish, Malware)
  MessageEvents 
  | where Timestamp > ago(30d)
  | where IsExternalThread==1 and IsOwnedThread==1
  | where ThreatTypes has_any ("Phish","Malware","Spam")                    
  | project Timestamp,TeamsMessageId, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId, ThreatTypes, DetectionMethods
version: 1.0.0