This hypothesis targets adversaries leveraging Microsoft Teams as a primary vector for initial access (T1566) by distributing malicious files that may bypass standard email gateways or user vigilance. Proactively hunting for this behavior in Azure Sentinel is critical to identify compromised file protection settings or undetected malware, ensuring that the collaboration platform is not exploited to establish a foothold within the organization.
//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365: files scanned, files with malware detected, and files scanned with no detection.
let base = FileMaliciousContentInfo
| where Timestamp > ago(30d)
| where Workload == "MicrosoftTeams";
union
(base | summarize Count = count() | extend Details = "Teams Files Scanned", Ord = 1),
(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = "Files with Malware Detected", Ord = 2),
(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = "Files Scanned - No Detection", Ord = 3)
| sort by Ord asc
| project Count, Details
id: 27ce9419-ad42-4fff-94df-9ad4b3c613ab
name: Teams File Protection Summary
description: |
This query summarizes Microsoft Teams file protection: files scanned, files with malware detected, and files with no detection.
description-detailed: |
This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365 - files scanned, files with malware detected, and files scanned with no detection, using Advanced hunting in Microsoft Defender XDR.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- FileMaliciousContentInfo
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
//This query summarizes Microsoft Teams file protection by Microsoft Defender for Office 365: files scanned, files with malware detected, and files scanned with no detection.
let base = FileMaliciousContentInfo
| where Timestamp > ago(30d)
| where Workload == "MicrosoftTeams";
union
(base | summarize Count = count() | extend Details = "Teams Files Scanned", Ord = 1),
(base | where isnotempty(ThreatTypes) | summarize Count = count() | extend Details = "Files with Malware Detected", Ord = 2),
(base | where isempty(ThreatTypes) | summarize Count = count() | extend Details = "Files Scanned - No Detection", Ord = 3)
| sort by Ord asc
| project Count, Details
version: 1.0.0
Scenario: An IT administrator performs a bulk upload of large, complex engineering files (e.g., .exe installers or nested .zip archives) to a shared Teams channel for a new software rollout. The Microsoft Defender for Cloud Apps (MDCA) or Microsoft 365 Defender engine may flag these as “suspicious” or “malicious” due to heuristic analysis of packed executables or known benign false positives in large archives, causing the “files with malware detected” count to spike during a routine deployment.
SecurityAdmins or ITDeployment) from the “malware detected” summary, or add a time-based exclusion window (e.g., 15 minutes) after bulk upload events logged in Azure AD sign-in or MDCA activity logs.Scenario: A scheduled PowerShell script or Power Automate flow runs nightly to archive old project files into a Teams “Archive” channel. These files are often compressed .7z or .tar.gz files that contain nested archives. The scanning engine may struggle with deep nesting or specific compression algorithms, leading to temporary “no detection” or false “malware” flags if the scanner times out or misinterprets the file structure during the high-volume batch process.
*Archive*, *Backup*) from the summary, or filter out file types .7z, .tar, and .gz if they are known to be internally managed and pre-scanned by an external AV solution.Scenario: A developer team shares a large, obfuscated JavaScript bundle (e.g., minified bundle.js or main.js) in a Teams channel for a