Teams Spam ZAP

id: f9e101e9-a71c-4ed5-a248-31965fe6ace6
name: Teams Spam ZAP
description: |
  This query helps hunt for Teams messages with Spam threats that have been ZAPed.
description-detailed: |
  This query helps hunt for Teams messages with Spam threats that have been ZAPed, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessagePostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Zero-hour auto purge (ZAP) took action on Teams messages containing Spam after delivery
  MessagePostDeliveryEvents
  | where ActionType == 'Spam ZAP' 
version: 1.0.0