Microsoft Teams External versus Internal Thread Exposure

Hunt Hypothesis

This rule identifies Microsoft Teams threads where internal conversations are exposed to external participants, a common vector for phishing or data exfiltration under MITRE technique T1566. Proactively hunting for these exposures allows the SOC to detect unauthorized sharing of sensitive internal communications before they lead to credential compromise or information leakage.

KQL Query

//This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.
MessageEvents
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by TeamsMessageId
| extend Thread = iif(IsExternalThread == true, "External Thread", "Internal Thread")
| summarize Count = count() by Thread
| render piechart

Analytic Rule Definition

id: b26c8461-8c9e-47ff-8b61-fe0f1fb8eea4
name: Microsoft Teams External versus Internal Thread Exposure
description: |
  This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.
description-detailed: |
  This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants, using Advanced hunting in Microsoft Defender XDR. External threads carry the higher risk of social-engineering and malicious content.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query shows de-duplicated Microsoft Teams messages split by whether the thread includes external participants.
  MessageEvents
  | where Timestamp > ago(30d)
  | summarize arg_max(Timestamp, *) by TeamsMessageId
  | extend Thread = iif(IsExternalThread == true, "External Thread", "Internal Thread")
  | summarize Count = count() by Thread
  | render piechart
version: 1.0.0

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Microsoft Teams External versus Internal Thread Exposure.yaml)

False Positive Guidance

• Scenario: IT Operations teams using Microsoft Teams to coordinate with a third-party cloud provider (e.g., AWS or Azure support) for incident resolution, where external engineers are added to internal troubleshooting channels.
  • Filter/Exclusion: Exclude threads where the channel name contains keywords like #incidents, #support, or #vendor and the external participant’s domain matches a known vendor list (e.g., @aws.com, @azure.com).
• Scenario: Procurement or Finance teams collaborating with external auditors or vendors in dedicated channels for contract reviews or audit evidence sharing, using SharePoint or OneDrive links posted within Teams.
  • Filter/Exclusion: Exclude messages in channels tagged with #procurement, #finance, or #audit where the external participant’s role is explicitly set to “Guest” and the message content includes standard audit-related keywords (e.g., “invoice”, “contract”, “evidence”).
• Scenario: Marketing teams coordinating with external creative agencies or PR firms for campaign launches, where external partners are added to project-specific channels for asset review and feedback.
  • Filter/Exclusion: Exclude threads in channels prefixed with #campaign- or #marketing- where the external participant’s domain belongs to a pre-approved agency list (e.g., @agency.com, @creativefirm.io) and the message timestamp falls within business hours.
• Scenario: HR teams onboarding new hires and coordinating with external background check services or payroll providers, where external staff are temporarily added to onboarding channels for document verification.
  • Filter/Exclusion: Exclude threads in channels named #onboarding or #hr-support where the external participant’s domain matches known HR service providers (e.g., @backgroundcheck.com, `@payrollprovider