Teams Malware ZAP

id: dc961519-a3d3-4b95-8459-982858f0cca6
name: Teams Malware ZAP
description: |
  This query helps hunt for Teams messages with Malware threats that have been ZAPed.
description-detailed: |
  This query helps hunt for Teams messages with Malware threats that have been ZAPed, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessagePostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Zero-hour auto purge (ZAP) took action on Teams messages containing Malware after delivery.
  MessagePostDeliveryEvents
  | where ActionType == 'Malware ZAP' 
version: 1.0.0