Top External Sender domains - Phish

id: e4a64b44-ec9a-4787-9f7a-75ff5394b928
name: Top External Sender domains - Phish
description: |
  Top External Sender domains sending Teams message with Phish threats
description-detailed: |
  This query helps hunt for Top External Sender domains sending Teams message with Phish threats, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Top External Sender domains sending Teams message with Phish threats
  MessageEvents
  | where IsExternalThread==1 and IsOwnedThread==0
  | where ThreatTypes contains "Phish"
  | extend SenderDomain = tostring(split(SenderEmailAddress, "@")[1])
  | summarize count() by SenderDomain
version: 1.0.0