← Back to SOC feed Coverage →

Possible Teams phishing activity

kql MEDIUM Azure-Sentinel
T1566
CloudAppEventsDeviceProcessEvents
huntingmicrosoftofficialphishing
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-11T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use Teams to initiate phishing campaigns by sending malicious links or attachments, leveraging the platform’s trusted communication channels to compromise users. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage phishing attempts before they lead to data exfiltration or lateral movement.

KQL Query

let suspiciousUpns = DeviceProcessEvents
| where DeviceId == "alertedMachine"
| where isnotempty(InitiatingProcessAccountUpn)
| project InitiatingProcessAccountUpn;
CloudAppEvents
| where Application == "Microsoft Teams"
| where ActionType == "ChatCreated"
| where isempty(AccountObjectId)
| where RawEventData.ParticipantInfo.HasForeignTenantUsers == true
| where RawEventData.CommunicationType == "OneonOne"
| where RawEventData.ParticipantInfo.HasGuestUsers == false
| where RawEventData.ParticipantInfo.HasOtherGuestUsers == false
| where RawEventData.Members[0].DisplayName in ("Microsoft  Security", "Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "office")
| where AccountId has "@"
| extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))
| where TargetUPN in (suspiciousUpns)

Analytic Rule Definition

id: ca7f7287-d688-4256-ae46-e68ad2f657c8
name: Possible Teams phishing activity
description: |
  This query looks for possible Teams phishing activity.
description-detailed: |
  This query looks for possible Teams phishing activity.
  Shared by Microsoft Threat Intelligence:https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let suspiciousUpns = DeviceProcessEvents
  | where DeviceId == "alertedMachine"
  | where isnotempty(InitiatingProcessAccountUpn)
  | project InitiatingProcessAccountUpn;
  CloudAppEvents
  | where Application == "Microsoft Teams"
  | where ActionType == "ChatCreated"
  | where isempty(AccountObjectId)
  | where RawEventData.ParticipantInfo.HasForeignTenantUsers == true
  | where RawEventData.CommunicationType == "OneonOne"
  | where RawEventData.ParticipantInfo.HasGuestUsers == false
  | where RawEventData.ParticipantInfo.HasOtherGuestUsers == false
  | where RawEventData.Members[0].DisplayName in ("Microsoft  Security", "Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "office")
  | where AccountId has "@"
  | extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))
  | where TargetUPN in (suspiciousUpns)
version: 1.0.0

Required Data Sources

Sentinel TableNotes
CloudAppEventsEnsure this data connector is enabled
DeviceProcessEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Possible Teams phishing activity.yaml