Potentially malicious URL click in Teams

id: be6ae743-71b5-4cbf-b5f0-e7c99c8bd197
name: Potentially malicious URL click in Teams
description: |
  This query provides insights on a potentially malicious URL click in Teams
description-detailed: |
  This query provides insights on a potentially malicious URL click in Teams where user was allowed to click on a URL in a message which was ZAP-d by Microsoft Defender for Office 365.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessagePostDeliveryEvents
  - MessageUrlInfo
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query provides insights on a potentially malicious URL click in Teams
  MessagePostDeliveryEvents
  | join MessageUrlInfo on TeamsMessageId
  | join UrlClickEvents on Url
  | where Workload == "Teams" and ActionType1=="ClickAllowed"
version: 1.0.0