Malicious files shared in Microsoft Teams

Hunt Hypothesis

This hypothesis targets adversaries leveraging the T1566 Phishing technique to deliver malicious payloads through Microsoft Teams, a common vector for initial access in modern cloud environments. Proactively hunting for these files allows the SOC to identify compromised users and isolate threats before lateral movement occurs, capitalizing on the integrated visibility provided by Microsoft Defender for Office 365 within Azure Sentinel.

KQL Query

//This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365.
FileMaliciousContentInfo
| where Timestamp > ago(30d)
| where Workload == "MicrosoftTeams"
| where isnotempty(ThreatTypes)
| top 20 by Timestamp desc
| project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256

Analytic Rule Definition

id: 7ad7e727-44f3-4b5b-80a4-b6b54d5eba5a
name: Malicious files shared in Microsoft Teams
description: |
  This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365.
description-detailed: |
  This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365, using Advanced hunting in Microsoft Defender XDR.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query lists Microsoft Teams files detected with malware by Microsoft Defender for Office 365.
  FileMaliciousContentInfo
  | where Timestamp > ago(30d)
  | where Workload == "MicrosoftTeams"
  | where isnotempty(ThreatTypes)
  | top 20 by Timestamp desc
  | project ['Time']=Timestamp, ['File Name']=FileName, ['Threat Type']=tostring(ThreatTypes), ['Threat Names']=ThreatNames, ['File Location']=FolderPath, ['File Owner']=FileOwnerUpn, SHA256
version: 1.0.0

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Malicious files shared in Microsoft Teams.yaml)

False Positive Guidance

• Scenario: Security teams or SOC analysts intentionally upload known malicious samples (e.g., EICAR test files, specific CVE exploit binaries) to Teams channels for analysis, sharing, or testing detection coverage.
  • Filter/Exclusion: Exclude files where the UserDisplayName matches specific security team groups (e.g., “SOC-Analysis”, “BlueTeam”) or where the FileName contains standard test identifiers like EICAR, TEST, or SAMPLE.
• Scenario: IT administrators or developers share legacy or third-party application installers (e.g., .exe files for internal tools, Java JRE updates, or specific vendor agents like CrowdStrike or SentinelOne) that may be flagged as “PUA” (Potentially Unwanted Application) or have outdated signatures in Defender for Office 365.
  • Filter/Exclusion: Exclude files where the FileType is exe and the FileName matches known internal tool names (e.g., setup.exe, installer.msi, agent.exe) or where the UserDisplayName is in the “IT-Admins” or “DevOps” group.
• Scenario: Marketing or HR departments share large presentation files or video assets that have been compressed or modified in a way that triggers heuristic false positives, or they share files from external partners that haven’t been fully scanned yet due to latency in Defender for Office 365.
  • Filter/Exclusion: Exclude files where the ThreatType is “PUA” (Potentially Unwanted Application) rather than “Malware”, or exclude files where the FileExtension is in a whitelist of common media/document types (e.g., pptx, mp4, zip) and the UserDisplayName is in “Marketing” or “HR” groups.
• Scenario: Automated bots