← Back to SOC feed Coverage →

Rare Domains in External Teams Messages

kql MEDIUM Azure-Sentinel
T1566T1204
UrlClickEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-11T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use rare domains in external Teams messages to evade detection and establish covert communication channels. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential exfiltration or command-and-control activities that leverage Microsoft Teams for lateral movement or data theft.

KQL Query

let lookback = 1d;
// External Teams messages 
let externalMsgs =
  MessageEvents
  | where Timestamp > ago(lookback) and IsExternalThread == true
  | project MsgTime = Timestamp, TeamsMessageId, SenderEmailAddress, ME_ReportId = ReportId;
// URLs found in Teams messages 
let urlsInMsgs =
  MessageUrlInfo
  | where Timestamp > ago(lookback)
  | project MUI_Time = Timestamp, TeamsMessageId, Url, UrlDomain, MUI_ReportId = ReportId;
// Clicks coming from Teams 
let clicks =
  UrlClickEvents
  | where Timestamp > ago(lookback) and Workload == "Teams"
  | project ClickTime = Timestamp, Url, Clicker = AccountUpn, ClickAction = ActionType, UCE_ReportId = ReportId;
// Define "rare" domains in the period 
let rareDomains =
  urlsInMsgs
  | summarize msgCount = dcount(TeamsMessageId) by UrlDomain
  | where msgCount < 3;
rareDomains
  | join kind=inner (urlsInMsgs) on UrlDomain
  | join kind=leftouter (externalMsgs) on TeamsMessageId
  | join kind=leftouter (clicks) on Url
  | project
      Timestamp = coalesce(ClickTime, MUI_Time, MsgTime),
      UrlDomain,
      Url,
      SenderEmailAddress,
      Clicker,
      ClickTime,
      ClickAction,
      TeamsMessageId,
      ReportId = coalesce(UCE_ReportId, MUI_ReportId, ME_ReportId)

Analytic Rule Definition

id: d4dd8c3f-d62b-4078-9dc7-8520c3adf1d5
name: Rare Domains in External Teams Messages
description: Detects rare domains (seen in fewer than 3 Teams messages) appearing in external Microsoft Teams threads within the last 24 hours.
description-detailed: >
  This query detects uncommon domains shared through external Microsoft Teams 
  message threads. Domains are classified as "rare" if they appear in fewer than 3 
  messages across your entire Teams environment, then filtered to show only those 
  appearing in external (cross-organization) threads. Results include sender 
  information, full URLs, and any user click actions from Teams, helping analysts 
  identify potential phishing attempts or social engineering targeting external 
  collaboration channels.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
  - MessageUrlInfo
  - UrlClickEvents
tactics:
  - InitialAccess
  - Execution
relevantTechniques:
  - T1566
  - T1204
query: |
  let lookback = 1d;
  // External Teams messages 
  let externalMsgs =
    MessageEvents
    | where Timestamp > ago(lookback) and IsExternalThread == true
    | project MsgTime = Timestamp, TeamsMessageId, SenderEmailAddress, ME_ReportId = ReportId;
  // URLs found in Teams messages 
  let urlsInMsgs =
    MessageUrlInfo
    | where Timestamp > ago(lookback)
    | project MUI_Time = Timestamp, TeamsMessageId, Url, UrlDomain, MUI_ReportId = ReportId;
  // Clicks coming from Teams 
  let clicks =
    UrlClickEvents
    | where Timestamp > ago(lookback) and Workload == "Teams"
    | project ClickTime = Timestamp, Url, Clicker = AccountUpn, ClickAction = ActionType, UCE_ReportId = ReportId;
  // Define "rare" domains in the period 
  let rareDomains =
    urlsInMsgs
    | summarize msgCount = dcount(TeamsMessageId) by UrlDomain
    | where msgCount < 3;
  rareDomains
    | join kind=inner (urlsInMsgs) on UrlDomain
    | join kind=leftouter (externalMsgs) on TeamsMessageId
    | join kind=leftouter (clicks) on Url
    | project
        Timestamp = coalesce(ClickTime, MUI_Time, MsgTime),
        UrlDomain,
        Url,
        SenderEmailAddress,
        Clicker,
        ClickTime,
        ClickAction,
        TeamsMessageId,
        ReportId = coalesce(UCE_ReportId, MUI_ReportId, ME_ReportId)
version: 1.0.0

Required Data Sources

Sentinel TableNotes
UrlClickEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Rare Domains in External Teams Messages.yaml