Changes to Blocked Teams Domains (NRT)

Description

This query detects changes to blocked Teams domains and can be used as an NRT detection.

Query · kql

CloudAppEvents
| where ActionType == "TeamsAdminAction"
| where RawEventData.AdminActionDetail has "Skype.Policy/configurations/TenantFederationSettings/configuration/Global"
| where RawEventData.ModifiedProperties has "BlockedDomains"
| extend ModifiedPropertiesName = RawEventData.ModifiedProperties[0].Name
| extend ModifiedPropertiesNewValue = extract_all(@"Domain=([^,]+)", tostring(RawEventData.ModifiedProperties[0].NewValue))
| extend ModifiedPropertiesOldValue = extract_all(@"Domain=([^,]+)", tostring(RawEventData.ModifiedProperties[0].OldValue))
| extend Action = iff(array_length(ModifiedPropertiesNewValue) > array_length(ModifiedPropertiesOldValue) or isempty(ModifiedPropertiesOldValue), "Domain Added", "Domain Removed")
| extend AddedFrom = iff(RawEventData.ExtraProperties has "80ccca67-54bd-44ab-8625-4b79c4dc7775", "TABL", "Teams Admin Centre")
//Uncomment below to only show domains added
//| where Action == "Domain Added"
| project Timestamp, AccountObjectId, AccountDisplayName, Application, ActionType, Action, AddedFrom, ModifiedPropertiesName, ModifiedPropertiesNewValue, ModifiedPropertiesOldValue, RawEventData, ReportId
Raw source Changes to Blocked Teams Domains (NRT) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f3ceca1b-8190-4511-beac-06b3368b8360
name:  Changes to Blocked Teams Domains (NRT)
description: |
  This query detects changes to blocked Teams domains and can be used as an NRT detection.
description-detailed: |
  This query detects domains being added or removed from blocked Teams domains. The changes could have been done from either TABL or Teams Admin Center. It can be set up as a Continuous (NRT) Custom Detection Rule to trigger an alert when changes occur.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562
query: |
  CloudAppEvents
  | where ActionType == "TeamsAdminAction"
  | where RawEventData.AdminActionDetail has "Skype.Policy/configurations/TenantFederationSettings/configuration/Global"
  | where RawEventData.ModifiedProperties has "BlockedDomains"
  | extend ModifiedPropertiesName = RawEventData.ModifiedProperties[0].Name
  | extend ModifiedPropertiesNewValue = extract_all(@"Domain=([^,]+)", tostring(RawEventData.ModifiedProperties[0].NewValue))
  | extend ModifiedPropertiesOldValue = extract_all(@"Domain=([^,]+)", tostring(RawEventData.ModifiedProperties[0].OldValue))
  | extend Action = iff(array_length(ModifiedPropertiesNewValue) > array_length(ModifiedPropertiesOldValue) or isempty(ModifiedPropertiesOldValue), "Domain Added", "Domain Removed")
  | extend AddedFrom = iff(RawEventData.ExtraProperties has "80ccca67-54bd-44ab-8625-4b79c4dc7775", "TABL", "Teams Admin Centre")
  //Uncomment below to only show domains added
  //| where Action == "Domain Added"
  | project Timestamp, AccountObjectId, AccountDisplayName, Application, ActionType, Action, AddedFrom, ModifiedPropertiesName, ModifiedPropertiesNewValue, ModifiedPropertiesOldValue, RawEventData, ReportId
version: 1.0.1

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.