This hypothesis targets phishing campaigns (T1566) where adversaries disproportionately target high-visibility or high-traffic users to maximize the impact of successful social engineering attacks. Proactively hunting for this pattern in Azure Sentinel allows the SOC to identify concentrated targeting efforts that may indicate a coordinated campaign or a compromised account being used to spearfish key personnel before a credential compromise occurs.
//This query lists the top 20 users who reported Microsoft Teams calls and messages over the last 30 days, counting calls
//and messages separately per reporter, with the reporting window. A user reporting several Teams calls in a short window
//is a strong sign of being actively targeted, and voice phishing is often layered onto Teams helpdesk impersonation so
//that malicious instructions never enter the chat log.
//Background: Microsoft Threat Intelligence, "Impersonating IT support: how threat actors turn a remote session into
//enterprise-wide access" (2 September 2026)
//https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
CloudAppEvents
| where Timestamp > ago(30d)
| extend RD = parse_json(RawEventData)
| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)
| where RecordType == "29" and SubmissionContentType in ("ChatMessage", "TeamsCall")
//Exact match, because a graded submission also emits a UserSubmissionTriage record under the same SubmissionId.
| where ActionType == "UserSubmission"
| extend ReportedBy = tostring(RD.SubmitterDisplayName), ReportedByEmail = tostring(RD.UserId)
| where isnotempty(ReportedBy) and ReportedByEmail has "@"
| summarize ['Teams Calls Reported'] = countif(SubmissionContentType == "TeamsCall"),
['Teams Messages Reported'] = countif(SubmissionContentType == "ChatMessage"),
['Total Reported'] = count(),
['First Reported'] = min(Timestamp),
['Last Reported'] = max(Timestamp)
by ['Reported By'] = ReportedBy, ['Reported By Email'] = ReportedByEmail
| top 20 by ['Total Reported']
id: d9ca4ab6-de3f-4c24-aaef-00d41332caf4
name: Top Reporters of Microsoft Teams Calls and Messages
description: |
This query lists the users who reported the most Microsoft Teams calls and messages, split by content type, to surface actively targeted people.
description-detailed: |
This query lists the top 20 users who reported Microsoft Teams calls and messages to Microsoft over the last 30 days, using Advanced hunting in Microsoft Defender XDR, with the count of Teams calls and Teams messages reported separately, and the first and last time each user reported. Splitting calls from messages per reporter is the point: a user reporting several Teams calls in a short window is a strong indicator of being actively targeted by helpdesk impersonation and voice phishing, which message-only reporting views do not reveal. The submitter email is included because display names alone do not disambiguate users.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- CloudAppEvents
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
//This query lists the top 20 users who reported Microsoft Teams calls and messages over the last 30 days, counting calls
//and messages separately per reporter, with the reporting window. A user reporting several Teams calls in a short window
//is a strong sign of being actively targeted, and voice phishing is often layered onto Teams helpdesk impersonation so
//that malicious instructions never enter the chat log.
//Background: Microsoft Threat Intelligence, "Impersonating IT support: how threat actors turn a remote session into
//enterprise-wide access" (2 September 2026)
//https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
CloudAppEvents
| where Timestamp > ago(30d)
| extend RD = parse_json(RawEventData)
| extend RecordType = tostring(RD.RecordType), SubmissionContentType = tostring(RD.SubmissionContentType)
| where RecordType == "29" and SubmissionContentType in ("ChatMessage", "TeamsCall")
//Exact match, because a graded submission also emits a UserSubmissionTriage record under the same SubmissionId.
| where ActionType == "UserSubmission"
| extend ReportedBy = tostring(RD.SubmitterDisplayName), ReportedByEmail = tostring(RD.UserId)
| where isnotempty(ReportedBy) and ReportedByEmail has "@"
| summarize ['Teams Calls Reported'] = countif(SubmissionContentType == "TeamsCall"),
['Teams Messages Reported'] = countif(SubmissionContentType == "ChatMessage"),
['Total Reported'] = count(),
['First Reported'] = min(Timestamp),
['Last Reported'] = max(Timestamp)
by ['Reported By'] = ReportedBy, ['Reported By Email'] = ReportedByEmail
| top 20 by ['Total Reported']
version: 1.0.0
| Sentinel Table | Notes |
|---|---|
CloudAppEvents | Ensure this data connector is enabled |
message or call events attributed to that specific user ID.
userType is Guest or where the assignedLicenses include “Microsoft 365 E3/E5” and the isManager flag is true, or specifically exclude known admin service accounts (e.g., svc-m365-admin) from the top N list.clientType is Bot or where the messageBody contains specific automated tags (e.g., [Auto-Reply], [System Notification]), or filter out users with the isBot property set to true in the Teams directory.call event counts.
jobTitle contains “Sales”, “Support”, or “Customer Success” if their callDuration is predominantly under 60 seconds, or apply a time-based window (e.g., only evaluate events during business hours 08:00–18:00) to reduce noise from after-hours batch jobs.