This hypothesis targets adversaries leveraging Microsoft Teams voice channels to conduct vishing attacks, where users report suspicious calls to indicate potential social engineering attempts. Proactively hunting for these reported calls allows the SOC to identify targeted vishing campaigns that may precede credential theft or lateral movement, enabling faster response to human-centric attack vectors in the Azure Sentinel environment.
//This query lists Microsoft Teams calls that users reported to Microsoft over the last 30 days, with the reporting
//user, the reported calling party and the submission state.
//Reported calls matter because voice phishing is often layered onto Teams helpdesk impersonation so that malicious
//instructions never enter the chat log. Background: Microsoft Threat Intelligence, "Impersonating IT support: how threat
//actors turn a remote session into enterprise-wide access" (2 September 2026)
//https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
CloudAppEvents
| where Timestamp > ago(30d)
| extend RD = parse_json(RawEventData)
| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)
| where RecordType == "29" and SubmissionContentType == "TeamsCall"
//Exact match, because a graded submission also emits a UserSubmissionTriage record under the same SubmissionId.
| where ActionType in ("UserSubmission", "AdminSubmission")
| extend ReportedBy = tostring(RD.SubmitterDisplayName),
ReportedByEmail = tostring(RD.UserId),
ReportedCaller = tostring(RD.P2Sender),
ReportedCallerDomain = tostring(RD.P2SenderDomain),
SubmissionState = tostring(RD.SubmissionState),
Reporter = iif(ActionType == "AdminSubmission", "Admin", "User")
| project Timestamp,
['Teams Call Reported By']=ReportedBy,
['Reported By Email']=ReportedByEmail,
['Reported Caller']=ReportedCaller,
['Reported Caller Domain']=ReportedCallerDomain,
['Reporter Type']=Reporter,
['Teams Call Submission State']=SubmissionState
| sort by Timestamp desc
id: 27cb923c-8d66-4caa-b52b-bce52e51d585
name: Reported Microsoft Teams Calls
description: |
This query lists Microsoft Teams calls that users reported to Microsoft, with the reporting user, to surface suspected voice phishing.
description-detailed: |
This query lists Microsoft Teams calls that users reported to Microsoft over the last 30 days, using Advanced hunting in Microsoft Defender XDR. It returns who reported the call, the reported calling party and its domain, and the submission state. Teams helpdesk impersonation is frequently paired with a voice call so that malicious instructions and URLs are spoken rather than typed, which keeps them out of the chat log entirely. A user-reported call is therefore one of the earliest first-party signals available for that intrusion pattern, and it is invisible to message-based hunting. Repeat reports naming the same calling party are the rows to investigate first.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- CloudAppEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
//This query lists Microsoft Teams calls that users reported to Microsoft over the last 30 days, with the reporting
//user, the reported calling party and the submission state.
//Reported calls matter because voice phishing is often layered onto Teams helpdesk impersonation so that malicious
//instructions never enter the chat log. Background: Microsoft Threat Intelligence, "Impersonating IT support: how threat
//actors turn a remote session into enterprise-wide access" (2 September 2026)
//https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
CloudAppEvents
| where Timestamp > ago(30d)
| extend RD = parse_json(RawEventData)
| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)
| where RecordType == "29" and SubmissionContentType == "TeamsCall"
//Exact match, because a graded submission also emits a UserSubmissionTriage record under the same SubmissionId.
| where ActionType in ("UserSubmission", "AdminSubmission")
| extend ReportedBy = tostring(RD.SubmitterDisplayName),
ReportedByEmail = tostring(RD.UserId),
ReportedCaller = tostring(RD.P2Sender),
ReportedCallerDomain = tostring(RD.P2SenderDomain),
SubmissionState = tostring(RD.SubmissionState),
Reporter = iif(ActionType == "AdminSubmission", "Admin", "User")
| project Timestamp,
['Teams Call Reported By']=ReportedBy,
['Reported By Email']=ReportedByEmail,
['Reported Caller']=ReportedCaller,
['Reported Caller Domain']=ReportedCallerDomain,
['Reporter Type']=Reporter,
['Teams Call Submission State']=SubmissionState
| sort by Timestamp desc
version: 1.0.0
| Sentinel Table | Notes |
|---|---|
CloudAppEvents | Ensure this data connector is enabled |
Scenario: A user reports a call because they accidentally clicked the “Report” button during a routine 1:1 or team meeting due to UI confusion, or because the call quality was poor (e.g., packet loss on a specific network segment) and they used the reporting feature as a feedback mechanism rather than a security alert.
CallDuration is less than 30 seconds or where the CallType is “1:1” and the ReportedReason is not explicitly “Voice Phishing” or “Suspicious Caller ID.” Additionally, correlate with NetworkConnection logs to exclude calls where the user was on a known unstable Wi-Fi network (e.g., “Guest-Network-5G”).Scenario: An IT administrator or support agent is performing a scheduled diagnostic test of the Teams voice infrastructure (e.g., using a test account or a known internal number) and reports the call to verify that the reporting pipeline is functioning correctly before a major upgrade or migration.
ReportingUser is a member of the “Teams-Admins” or “IT-Support” security group, or where the CallerNumber matches a known internal test range (e.g., +1-555-0100 to +1-555-0199).Scenario: A user is on a legitimate external business call with a vendor who uses a dynamic or unfamiliar SIP trunk number, and the user reports the call to flag it for follow-up or to document a billing dispute, not necessarily because they suspect phishing.
ReportedReason is “Billing Dispute” or “Follow-up Required,” or where the CallerNumber is present in the organization