Top Microsoft Teams Senders Removed by Zero-Hour Auto Purge

Hunt Hypothesis

This hypothesis targets adversaries leveraging Microsoft Teams as a primary vector for phishing or malware delivery (T1566), where a high volume of messages is automatically removed by zero-hour auto-purge, indicating successful initial compromise or mass spamming. Proactively hunting for this anomaly in Azure Sentinel allows the SOC to identify compromised accounts or active phishing campaigns that may have been silently cleaned up by the platform, ensuring rapid containment before lateral movement occurs.

KQL Query

//This query ranks Microsoft Teams senders by messages removed after delivery by zero-hour auto purge over the last
//30 days, with malware and phish removals split out.
//Each removal is a message that passed initial filtering and reached a mailbox before being retracted, so a sender
//appearing repeatedly is consistently getting through the first line of defence. Aggregating by sender surfaces
//that pattern, which per-message ZAP queries cannot show.
MessagePostDeliveryEvents
| where Timestamp > ago(30d)
| where isnotempty(SenderEmailAddress)
| summarize ZapActions = count(),
            MalwareZAP = countif(ActionType == "Malware ZAP"),
            PhishZAP = countif(ActionType == "Phish ZAP"),
            FirstRemoval = min(Timestamp),
            LastRemoval = max(Timestamp)
    by SenderEmailAddress
| top 20 by ZapActions
| project ['Teams Sender']=SenderEmailAddress, ['Messages Removed by ZAP']=ZapActions,
          ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP,
          ['First Removal']=FirstRemoval, ['Last Removal']=LastRemoval

Analytic Rule Definition

id: c5fe6338-89a9-49f5-a75e-251b1e2cff11
name: Top Microsoft Teams Senders Removed by Zero-Hour Auto Purge
description: |
  This query ranks Microsoft Teams senders by how many of their messages were removed after delivery by zero-hour auto purge, split by malware and phish.
description-detailed: |
  This query ranks Microsoft Teams senders by the number of their messages that zero-hour auto purge removed after delivery over the last 30 days, using Advanced hunting in Microsoft Defender XDR, with malware and phish removals counted separately and the first and last removal timestamps. Existing queries list the messages that were purged; this one aggregates by sender, which answers a different question. Every removal here represents a message that passed initial filtering and reached a mailbox before being retracted, so a sender appearing repeatedly is one that is consistently getting through the first line of defence. That pattern is invisible when looking at individual purged messages, and it is the sender worth blocking, investigating or feeding to threat intelligence.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessagePostDeliveryEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //This query ranks Microsoft Teams senders by messages removed after delivery by zero-hour auto purge over the last
  //30 days, with malware and phish removals split out.
  //Each removal is a message that passed initial filtering and reached a mailbox before being retracted, so a sender
  //appearing repeatedly is consistently getting through the first line of defence. Aggregating by sender surfaces
  //that pattern, which per-message ZAP queries cannot show.
  MessagePostDeliveryEvents
  | where Timestamp > ago(30d)
  | where isnotempty(SenderEmailAddress)
  | summarize ZapActions = count(),
              MalwareZAP = countif(ActionType == "Malware ZAP"),
              PhishZAP = countif(ActionType == "Phish ZAP"),
              FirstRemoval = min(Timestamp),
              LastRemoval = max(Timestamp)
      by SenderEmailAddress
  | top 20 by ZapActions
  | project ['Teams Sender']=SenderEmailAddress, ['Messages Removed by ZAP']=ZapActions,
            ['Malware ZAP']=MalwareZAP, ['Phish ZAP']=PhishZAP,
            ['First Removal']=FirstRemoval, ['Last Removal']=LastRemoval
version: 1.0.0

MITRE ATT&CK Context

Tactic: InitialAccess
Technique: T1566 — T1566

References

[Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Top Microsoft Teams Senders Removed by Zero-Hour Auto Purge.yaml)

False Positive Guidance

Scenario: A marketing or communications team uses a shared service account (e.g., svc-teams-broadcast) to send high-volume campaign messages to large distribution lists. If a minor formatting error or attachment issue triggers a bulk recall/purge, the sender appears as a “top” remover despite the action being intentional and administrative.
- Filter/Exclusion: Exclude senders whose UPN matches known service account patterns (e.g., svc-*, bot-*, shared-*) or those belonging to specific administrative groups like “Teams Admins” or “Communications Service Accounts.”
Scenario: An IT operations team performs a scheduled cleanup of a specific channel or chat thread that was used for a temporary project. They use the Microsoft Graph API or Teams Admin Center to bulk-delete messages, which registers as zero-hour purges for the user performing the action.
- Filter/Exclusion: Correlate with Azure AD Sign-in logs or Graph API audit logs; exclude senders who have a corresponding “DeleteMessage” or “DeleteChat” audit event within a 5-minute window of the purge timestamp.
Scenario: A developer or QA engineer tests a new bot or integration that sends test messages to a small group. If the bot has a bug that causes it to auto-purge messages after a short delay (e.g., for cleanup), the human owner of the bot application may be attributed as the sender, or the bot’s service principal may appear as a high-volume purger.
- Filter/Exclusion: Exclude senders identified as “Bot” or “Application” in the Teams message metadata, or exclude users who are members of the “Teams Bot Developers” or “Integration QA” security group.
Scenario: A user sends a message containing a large file or sensitive data to a small group, then immediately realizes an error (e.g., wrong