Microsoft Teams chat initiated by a suspicious external user

Hunt Hypothesis

Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages.

KQL Query

//Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external  Teams messages
AlertInfo 
| where Timestamp >= ago(30d) 
| where Title == "Microsoft Teams chat initiated by a suspicious external user" 
| join AlertEvidence on AlertId
| top 100 by Timestamp

Analytic Rule Definition

id: 8b88ecaf-88b3-4d70-814f-a55b96748ff5
name: Microsoft Teams chat initiated by a suspicious external user
description: |
  Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external Teams messages.
description-detailed: |
  This query uses AlertInfo and AlertEvidence tables to collect general information and clickable links to more IOCs about suspicious external Teams messages.
  Shared by Microsoft Threat Intelligence:https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/protection-against-multi-modal-attacks-with-microsoft-defender/4438786
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - AlertInfo
  - AlertEvidence
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Use AlertInfo and AlertEvidence to collect general information and clickable links to more IOCs about suspicious external  Teams messages
  AlertInfo 
  | where Timestamp >= ago(30d) 
  | where Title == "Microsoft Teams chat initiated by a suspicious external user" 
  | join AlertEvidence on AlertId
  | top 100 by Timestamp
version: 1.0.0

Required Data Sources

False Positive Guidance

• Scenario: Scheduled backup tool notification
  *

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1566 — T1566

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Microsoft Teams chat initiated by a suspicious external user.yaml)