This hypothesis targets adversaries leveraging Microsoft Teams to deliver phishing links that bypass initial filters but trigger URL safety warnings, indicating a high likelihood of successful social engineering attacks. Proactively hunting for senders with elevated warning rates allows the SOC to identify compromised accounts or targeted campaigns early, reducing the window for attackers to exploit user trust before a click occurs.
//This query lists Microsoft Teams senders whose messages triggered a URL safety-tip warning over the last 30 days,
//with each sender's total messages and warning rate.
//A safety tip fires at the moment a user is about to act, so it flags content considered risky enough to interrupt
//someone over even when no threat verdict was assigned. A low-volume sender with a high warning rate matters most.
//Messages are de-duplicated to the latest record per message.
let DedupedMessages = MessageEvents
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by TeamsMessageId;
let SenderTotals = DedupedMessages
| summarize TotalMessages = count() by SenderEmailAddress;
DedupedMessages
| where SafetyTip == "URLMessageWarning"
| summarize WarningMessages = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
by SenderEmailAddress
| join kind=leftouter (SenderTotals) on SenderEmailAddress
| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)
| top 20 by WarningMessages desc
| project ['Teams Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages,
['Total Teams Messages']=TotalMessages, ['Warning %']=WarningPct,
['First Seen']=FirstSeen, ['Last Seen']=LastSeen
id: f5279911-c49c-4fbe-8b5c-be61e28263a2
name: Microsoft Teams Senders Triggering URL Safety Tips
description: |
This query lists the Microsoft Teams senders whose messages most often triggered a URL safety-tip warning, with each sender's warning rate.
description-detailed: |
This query lists the Microsoft Teams senders whose messages triggered a URL safety-tip warning over the last 30 days, using Advanced hunting in Microsoft Defender XDR, alongside each sender's total Teams messages and the share that carried a warning. The safety tip is the control that fires at the moment a user is about to act, so it marks content the platform considered risky enough to interrupt someone over, whether or not a threat verdict was ever assigned. That makes it a useful signal in its own right and one that threat-based hunting misses entirely. A sender with a low message count but a very high warning rate is more interesting than a high-volume sender with an occasional warning. Messages are de-duplicated to the latest record per message.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- MessageEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
//This query lists Microsoft Teams senders whose messages triggered a URL safety-tip warning over the last 30 days,
//with each sender's total messages and warning rate.
//A safety tip fires at the moment a user is about to act, so it flags content considered risky enough to interrupt
//someone over even when no threat verdict was assigned. A low-volume sender with a high warning rate matters most.
//Messages are de-duplicated to the latest record per message.
let DedupedMessages = MessageEvents
| where Timestamp > ago(30d)
| summarize arg_max(Timestamp, *) by TeamsMessageId;
let SenderTotals = DedupedMessages
| summarize TotalMessages = count() by SenderEmailAddress;
DedupedMessages
| where SafetyTip == "URLMessageWarning"
| summarize WarningMessages = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
by SenderEmailAddress
| join kind=leftouter (SenderTotals) on SenderEmailAddress
| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)
| top 20 by WarningMessages desc
| project ['Teams Sender']=SenderEmailAddress, ['Warning Messages']=WarningMessages,
['Total Teams Messages']=TotalMessages, ['Warning %']=WarningPct,
['First Seen']=FirstSeen, ['Last Seen']=LastSeen
version: 1.0.0
Scenario: IT Support or Service Desk agents using a shared mailbox or automated bot to send standardized onboarding packets, password reset links, or software download instructions (e.g., links to portal.office.com or internal SharePoint sites) to multiple users simultaneously.
svc-teams-support@domain.com) or filter for messages where the URL domain matches a known internal trusted list (e.g., *.sharepoint.com, *.teams.microsoft.com) and the sender’s display name contains “Support” or “Service Desk.”Scenario: DevOps or Platform Engineering teams posting deployment status updates, CI/CD pipeline artifacts, or release notes in team channels, often containing long, dynamic URLs to internal artifact repositories (e.g., Azure DevOps, JFrog Artifactory, or GitHub Enterprise) that may be flagged due to length or new subdomains.
sg-devops-automation) or filter for URLs ending in known internal TLDs (e.g., .internal, .corp) or specific artifact repository domains (e.g., *.dev.azure.com, *.artifactory.example.com).Scenario: Marketing or Communications teams distributing campaign-specific landing pages, event registration links, or newsletter archives via Teams announcements, where URLs are frequently updated or use shorteners (e.g., bit.ly, tinyurl.com) that may not be pre-whitelisted in the URL safety tip policy.
sg-marketing-communications group or filter for messages where the URL host is a known shortener service (e.g., bit.ly, tinyurl.com) and the sender’s role is “Marketing” or “Communications