First-Contact External Teams Senders

Hunt Hypothesis

This hypothesis targets T1566 (Phishing) by identifying external Microsoft Teams users who are initiating contact for the first time, a common precursor to social engineering attacks or compromised account usage. Proactively hunting for these first-contact senders allows the SOC to validate new external identities and assess their legitimacy before they can establish a foothold or deliver malicious payloads within the collaboration environment.

KQL Query

//This query lists external Microsoft Teams senders by the date they were first seen over the last 30 days, surfacing recent first-contact senders.
MessageEvents
| where Timestamp > ago(30d)
| summarize FirstTimestamp = min(Timestamp), arg_max(Timestamp, *) by TeamsMessageId
| where IsExternalThread == true
| summarize FirstSeen = min(FirstTimestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress
| top 20 by FirstSeen desc
| project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages

Analytic Rule Definition

id: 667772be-deff-4c7e-9da6-ada1780cc45c
name: First-Contact External Teams Senders
description: |
  This query lists external Microsoft Teams senders by the date they were first seen, surfacing recent first-contact senders.
description-detailed: |
  This query lists external Microsoft Teams senders by the date they were first seen over the last 30 days, surfacing recent first-contact senders, using Advanced hunting in Microsoft Defender XDR. First contact from an unknown external sender is a common precursor to social-engineering.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query lists external Microsoft Teams senders by the date they were first seen over the last 30 days, surfacing recent first-contact senders.
  MessageEvents
  | where Timestamp > ago(30d)
  | summarize FirstTimestamp = min(Timestamp), arg_max(Timestamp, *) by TeamsMessageId
  | where IsExternalThread == true
  | summarize FirstSeen = min(FirstTimestamp), Messages = count(), ThreatMessages = countif(isnotempty(ThreatTypes)) by SenderEmailAddress
  | top 20 by FirstSeen desc
  | project ['Sender']=SenderEmailAddress, ['First Seen']=FirstSeen, ['Messages']=Messages, ['Threat Messages']=ThreatMessages
version: 1.0.0

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/First-Contact External Teams Senders.yaml)

False Positive Guidance

• Scenario: A new vendor or partner is onboarded and invited to the Microsoft 365 tenant via the “Guest Access” portal or direct email invitation, creating their first external identity record in Azure AD/Entra ID.
  • Filter/Exclusion: Exclude senders whose userType is “Guest” and whose createdDateTime falls within the last 24–48 hours, or correlate with recent “User Invited” audit logs in Microsoft Graph.
• Scenario: An automated service account or integration bot (e.g., Jira, ServiceNow, or a custom CI/CD pipeline) is configured to post updates to a shared Teams channel, resulting in a new external app identity or guest user being created for the first time.
  • Filter/Exclusion: Exclude senders associated with known application IDs or service principal names, or filter out users where the displayName matches known bot naming conventions (e.g., *Bot, *Service, *Integration).
• Scenario: A temporary contractor or external consultant is added to a project-specific Teams team for a short duration, triggering a first-contact event upon their initial message.
  • Filter/Exclusion: Exclude senders whose userPrincipalName contains domain suffixes associated with known contractor pools (e.g., @contractor.com, @tempstaff.org) or those with a jobTitle field containing “Contractor” or “Consultant” in Azure AD.
• Scenario: A scheduled external data feed or reporting tool (e.g., Power BI embedded content or a third-party analytics dashboard) sends a daily digest to a Teams channel, creating a new external sender identity if the underlying service account was recently provisioned or re-authenticated.
  • Filter/Exclusion: Exclude senders whose messageCount is low (e.g.,