← Back to SOC feed Coverage →

Hunt for malicious messages using External Threat Intelligence

kql MEDIUM Azure-Sentinel
T1566
UrlClickEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-11T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use malicious URLs embedded in Teams messages to deliver payloads, leveraging external threat intelligence to evade traditional detection. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential compromise through covert communication channels.

KQL Query

// This query helps hunt for Teams messages with malicious URLs based on external IOC source
let url = (externaldata(url: string )
[@"https://urlhaus.abuse.ch/downloads/text_online/"]
with (format="txt"))
| project url;
url
| join (MessageUrlInfo
| where Timestamp > ago(14d) 
) on $left.url == $right.Url
|join MessageEvents on TeamsMessageId
//|join UrlClickEvents on Url
|project Timestamp, TeamsMessageId, Url, UrlDomain, SenderEmailAddress, SenderDisplayName, RecipientDetails,ThreatTypes, DetectionMethods, DeliveryAction,IsExternalThread, IsOwnedThread//, AccountUpn, ActionType, AppName, AppVersion, Workload

Analytic Rule Definition

id: 4dcb872f-9b39-4b95-8f30-3664f9f70dc2
name: Hunt for malicious messages using External Threat Intelligence
description: |
  This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source
description-detailed: |
  This query helps hunt for Teams messages with malicious URLs based on external Threat Intelligence source using Microsoft Defender for Office 365 and Advance hunting in Microsoft Defender XDR
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageUrlInfo
  - MessageEvents
  - UrlClickEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  // This query helps hunt for Teams messages with malicious URLs based on external IOC source
  let url = (externaldata(url: string )
  [@"https://urlhaus.abuse.ch/downloads/text_online/"]
  with (format="txt"))
  | project url;
  url
  | join (MessageUrlInfo
  | where Timestamp > ago(14d) 
  ) on $left.url == $right.Url
  |join MessageEvents on TeamsMessageId
  //|join UrlClickEvents on Url
  |project Timestamp, TeamsMessageId, Url, UrlDomain, SenderEmailAddress, SenderDisplayName, RecipientDetails,ThreatTypes, DetectionMethods, DeliveryAction,IsExternalThread, IsOwnedThread//, AccountUpn, ActionType, AppName, AppVersion, Workload
version: 1.0.0

Required Data Sources

Sentinel TableNotes
UrlClickEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Hunt for malicious messages using External Threat Intelligence.yaml