This hypothesis targets adversaries leveraging T1566 (Phishing) to distribute malicious links that trigger Microsoft Teams’ safety tips, indicating a high likelihood of user interaction with untrusted external domains. Proactively hunting for these specific URL domains allows the SOC to identify potential phishing campaigns or compromised internal channels before they lead to credential theft or malware execution.
//This query lists URL domains appearing in Microsoft Teams messages that triggered a safety-tip warning over the
//last 30 days, with each domain's total message appearances and warning rate.
//Domains are the actionable artefact: they can be blocked, pivoted on across email, and matched to threat
//intelligence, whereas a sender identity is disposable. A warning rate near 100% is rarely incidental.
//The safety tip is a message-level signal, so where a warned message carried several URLs the tip cannot be
//attributed to one domain. The rate below is the share of messages containing this domain that also carried a URL
//safety tip for any URL in that message.
let WarnedMessages = MessageEvents
| where Timestamp > ago(30d)
| where SafetyTip == "URLMessageWarning"
| distinct TeamsMessageId;
let DomainTotals = MessageUrlInfo
| where Timestamp > ago(30d)
| where isnotempty(UrlDomain)
| summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;
MessageUrlInfo
| where Timestamp > ago(30d)
| where isnotempty(UrlDomain)
| where TeamsMessageId in (WarnedMessages)
| summarize WarningMessages = dcount(TeamsMessageId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
by UrlDomain
| join kind=leftouter (DomainTotals) on UrlDomain
| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)
| top 20 by WarningMessages desc
| project ['URL Domain']=UrlDomain, ['Messages With a URL Safety Tip']=WarningMessages,
['Total Teams Messages']=TotalMessages, ['Messages With a URL Safety Tip %']=WarningPct,
['First Seen']=FirstSeen, ['Last Seen']=LastSeen
id: 9a0669b6-abc4-4006-ac14-13bf798c999e
name: URL Domains Triggering Microsoft Teams Safety Tips
description: |
This query lists the URL domains appearing in Microsoft Teams messages that triggered a safety-tip warning, with each domain's warning rate.
description-detailed: |
This query lists the URL domains that appeared in Microsoft Teams messages which triggered a URL safety-tip warning over the last 30 days, using Advanced hunting in Microsoft Defender XDR, alongside the total number of Teams messages each domain appeared in and the share of those that carried a warning. The safety tip is raised on the message rather than on an individual link, so where a warned message carried several URLs the warning cannot be attributed to a single domain; the rate here is the share of messages containing this domain that also carried a URL safety tip for any URL in that message. Where the companion sender-focused query answers who is sending risky links, this one answers which infrastructure is behind them, which is the form an analyst can act on: domains can be blocked, searched for across email, and matched against threat intelligence, whereas a sender identity is disposable. A domain with a warning rate at or near 100 percent is almost never incidental.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- MessageEvents
- MessageUrlInfo
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
//This query lists URL domains appearing in Microsoft Teams messages that triggered a safety-tip warning over the
//last 30 days, with each domain's total message appearances and warning rate.
//Domains are the actionable artefact: they can be blocked, pivoted on across email, and matched to threat
//intelligence, whereas a sender identity is disposable. A warning rate near 100% is rarely incidental.
//The safety tip is a message-level signal, so where a warned message carried several URLs the tip cannot be
//attributed to one domain. The rate below is the share of messages containing this domain that also carried a URL
//safety tip for any URL in that message.
let WarnedMessages = MessageEvents
| where Timestamp > ago(30d)
| where SafetyTip == "URLMessageWarning"
| distinct TeamsMessageId;
let DomainTotals = MessageUrlInfo
| where Timestamp > ago(30d)
| where isnotempty(UrlDomain)
| summarize TotalMessages = dcount(TeamsMessageId) by UrlDomain;
MessageUrlInfo
| where Timestamp > ago(30d)
| where isnotempty(UrlDomain)
| where TeamsMessageId in (WarnedMessages)
| summarize WarningMessages = dcount(TeamsMessageId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
by UrlDomain
| join kind=leftouter (DomainTotals) on UrlDomain
| extend WarningPct = round(100.0 * WarningMessages / TotalMessages, 1)
| top 20 by WarningMessages desc
| project ['URL Domain']=UrlDomain, ['Messages With a URL Safety Tip']=WarningMessages,
['Total Teams M
Automated Deployment and Release Notes Distribution: When IT operations or DevOps teams use chatbots (e.g., via Microsoft Flow/Power Automate or custom bots) to post release notes, deployment status, or changelogs to channel threads, the messages often contain links to internal artifact repositories (e.g., artifacts.azure.com, dev.azure.com, or internal Jira/Confluence instances). If these domains are not explicitly allowlisted in the Teams admin center, the safety tip triggers on every automated post.
*.dev.azure.com, artifacts.azure.com) to the “Allowed domains” list in the Microsoft Teams admin center under “Safety tips” settings.Scheduled Reporting and Dashboard Links: Business Intelligence (BI) tools or data platforms (e.g., Power BI, Tableau, or internal Grafana instances) often send scheduled email or chat notifications to Teams channels containing deep links to dashboards. If the link uses a subdomain not previously seen or if the domain is slightly different from the primary entry (e.g., app.powerbi.com vs. workspace.powerbi.com), Teams may flag it as a new or unverified domain.
*.powerbi.com, add that wildcard or specific subdomains like app.powerbi.com and workspace.powerbi.com to the allowlist.Internal Wiki and Knowledge Base Updates: When employees or bots post links to internal knowledge bases (e.g., Confluence, SharePoint, or custom internal wiki platforms) that use non-standard or newly provisioned subdomains (e.g., wiki.corp.example.com vs. `confluence.example.com