This hypothesis targets potential phishing or social engineering campaigns (T1566) where adversaries leverage Microsoft Teams to deliver malicious payloads or credentials via calls and messages, often bypassing traditional email filters. Proactively hunting for spikes in user- or admin-reported submissions allows the SOC to identify emerging attack vectors or targeted spear-phishing attempts before they result in successful compromise or lateral movement within the Azure environment.
//This query trends Microsoft Teams call and message submissions over the last 30 days, split by content type and reporter.
//A rise in reported Teams calls against flat message reporting is the shape to investigate, because voice phishing is often
//layered onto Teams helpdesk impersonation so that malicious instructions never enter the chat log.
//Background: Microsoft Threat Intelligence, "Impersonating IT support: how threat actors turn a remote session into
//enterprise-wide access" (2 September 2026)
//https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
CloudAppEvents
| where Timestamp > ago(30d)
| extend RD = parse_json(RawEventData)
| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)
| where RecordType == "29" and SubmissionContentType in ("ChatMessage", "TeamsCall")
//Exact match, because a graded submission also emits a UserSubmissionTriage record under the same SubmissionId.
| where ActionType in ("UserSubmission", "AdminSubmission")
| extend SubmissionType = iif(SubmissionContentType == "TeamsCall", "Teams Call", "Teams Message"),
Reporter = iif(ActionType == "AdminSubmission", "Admin", "User")
| summarize Submissions = count() by bin(Timestamp, 1d), ['Submission Type'] = strcat(SubmissionType, " (", Reporter, ")")
| render timechart
id: 6dcfd16d-d9f0-45d1-a9d3-cb08fbf8465b
name: Microsoft Teams Call and Message Submissions Over Time
description: |
This query trends Microsoft Teams call and message submissions over time, split by content type and by whether a user or an admin reported them.
description-detailed: |
This query trends Microsoft Teams call and message submissions over the last 30 days, using Advanced hunting in Microsoft Defender XDR, split into four series: Teams calls and Teams messages, each reported by a user or submitted by an admin. A rise in Teams calls reported by users while message reporting stays flat is the shape worth investigating, because voice phishing is commonly layered onto Teams helpdesk impersonation so that malicious instructions are spoken rather than typed and never appear in the chat log.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- CloudAppEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
//This query trends Microsoft Teams call and message submissions over the last 30 days, split by content type and reporter.
//A rise in reported Teams calls against flat message reporting is the shape to investigate, because voice phishing is often
//layered onto Teams helpdesk impersonation so that malicious instructions never enter the chat log.
//Background: Microsoft Threat Intelligence, "Impersonating IT support: how threat actors turn a remote session into
//enterprise-wide access" (2 September 2026)
//https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
CloudAppEvents
| where Timestamp > ago(30d)
| extend RD = parse_json(RawEventData)
| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)
| where RecordType == "29" and SubmissionContentType in ("ChatMessage", "TeamsCall")
//Exact match, because a graded submission also emits a UserSubmissionTriage record under the same SubmissionId.
| where ActionType in ("UserSubmission", "AdminSubmission")
| extend SubmissionType = iif(SubmissionContentType == "TeamsCall", "Teams Call", "Teams Message"),
Reporter = iif(ActionType == "AdminSubmission", "Admin", "User")
| summarize Submissions = count() by bin(Timestamp, 1d), ['Submission Type'] = strcat(SubmissionType, " (", Reporter, ")")
| render timechart
version: 1.0.0
| Sentinel Table | Notes |
|---|---|
CloudAppEvents | Ensure this data connector is enabled |
Scenario: Scheduled Compliance or Audit Reports
UserType is ServicePrincipal or where the Source is identified as an API call from a known compliance service account (e.g., compliance-reporting-svc). Alternatively, filter out submissions where the ReportedBy field is an admin account with a specific tag like Compliance-Audit.Scenario: New User Onboarding or Bulk Provisioning
UserAge (days since account creation) < 1 day if the rule allows attribute filtering, or exclude submissions from users with LicenseStatus = NewlyProvisioned.Scenario: Teams Meeting Recording or Transcription Processing