Possible Teams phishing activity

Description

This query looks for possible Teams phishing activity.

Query · kql

let suspiciousUpns = DeviceProcessEvents
| where DeviceId == "alertedMachine"
| where isnotempty(InitiatingProcessAccountUpn)
| project InitiatingProcessAccountUpn;
CloudAppEvents
| where Application == "Microsoft Teams"
| where ActionType == "ChatCreated"
| where isempty(AccountObjectId)
| where RawEventData.ParticipantInfo.HasForeignTenantUsers == true
| where RawEventData.CommunicationType == "OneonOne"
| where RawEventData.ParticipantInfo.HasGuestUsers == false
| where RawEventData.ParticipantInfo.HasOtherGuestUsers == false
| where RawEventData.Members[0].DisplayName in ("Microsoft  Security", "Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "office")
| where AccountId has "@"
| extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))
| where TargetUPN in (suspiciousUpns)
Raw source Possible Teams phishing activity · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ca7f7287-d688-4256-ae46-e68ad2f657c8
name: Possible Teams phishing activity
description: |
  This query looks for possible Teams phishing activity.
description-detailed: |
  This query looks for possible Teams phishing activity.
  Shared by Microsoft Threat Intelligence:https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let suspiciousUpns = DeviceProcessEvents
  | where DeviceId == "alertedMachine"
  | where isnotempty(InitiatingProcessAccountUpn)
  | project InitiatingProcessAccountUpn;
  CloudAppEvents
  | where Application == "Microsoft Teams"
  | where ActionType == "ChatCreated"
  | where isempty(AccountObjectId)
  | where RawEventData.ParticipantInfo.HasForeignTenantUsers == true
  | where RawEventData.CommunicationType == "OneonOne"
  | where RawEventData.ParticipantInfo.HasGuestUsers == false
  | where RawEventData.ParticipantInfo.HasOtherGuestUsers == false
  | where RawEventData.Members[0].DisplayName in ("Microsoft  Security", "Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "office")
  | where AccountId has "@"
  | extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))
  | where TargetUPN in (suspiciousUpns)
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.