Number of unique accounts performing Teams message Admin submissions

id: dc230eec-acc2-482f-8601-25125c8ff122
name: Number of unique accounts performing Teams message Admin submissions
description: |
  This query visualises number of unqiue accounts performing Teams message admin submissions as false negatives or false positives
description-detailed: |
 This query visualises number of unqiue accounts performing Teams message admin submissions as false negatives or false positives
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "AdminSubmissionSubmitted"
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType),SubmittedBy=tostring((parse_json(RawEventData)).UserId)
  | where SubmissionContentType == "ChatMessage" and SubmissionType in ("1","2","3")
  | summarize dcount(SubmittedBy) 
version: l.0.0