← Back to SOC feed Coverage →

Malicious Teams messages received from external senders

kql MEDIUM Azure-Sentinel
T1566
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-11T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use malicious Teams messages from external senders to deliver phishing content or exfiltrate data. SOC teams should proactively hunt for this behavior to identify and mitigate potential compromise vectors in their Azure Sentinel environment.

KQL Query

//This query helps hunt for Teams messages from external senders with Threats (Spam, Phish, Malware)
MessageEvents 
| where Timestamp > ago(30d)
| where IsExternalThread==1 and IsOwnedThread==0
| where ThreatTypes has_any ("Phish","Malware","Spam")                    
| project Timestamp,TeamsMessageId, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId, ThreatTypes, DetectionMethods

Analytic Rule Definition

id: ac842e4d-0c7d-4980-b09d-c761f3de0a79
name: Malicious Teams messages received from external senders
description: |
  This query helps hunt for malicious Teams messages received from external senders.
description-detailed: |
  This query helps hunt for Malicious Teams messages received from external senders, using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query helps hunt for Teams messages from external senders with Threats (Spam, Phish, Malware)
  MessageEvents 
  | where Timestamp > ago(30d)
  | where IsExternalThread==1 and IsOwnedThread==0
  | where ThreatTypes has_any ("Phish","Malware","Spam")                    
  | project Timestamp,TeamsMessageId, SenderDisplayName, SenderEmailAddress, RecipientDetails, IsOwnedThread, ThreadType, IsExternalThread, ReportId, ThreatTypes, DetectionMethods
version: 1.0.0

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Malicious Teams messages received from external senders.yaml