← Back to SOC feed Coverage →

Teams User submissions daily trend

kql MEDIUM Azure-Sentinel
T1566
CloudAppEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-12T11:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may exploit Teams message submission mechanisms to bypass detection by generating false positives or negatives, leveraging T1566 to evade monitoring. SOC teams should proactively hunt for this behavior to identify potential obfuscation tactics used in advanced persistent threats within their Azure Sentinel environment.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
let baseQuery=CloudAppEvents
| extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
| where ActionType == "UserSubmission" and SubmissionContentType == "ChatMessage";
let User_TeamsSubmission_FN_FP=baseQuery
| make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| extend Details = "User_TeamsSubmission_FN_FP";
union User_TeamsSubmission_FN_FP
| project Count, Details, Timestamp
| render timechart

Analytic Rule Definition

id: ace8e98a-660b-4fa9-a877-60644eb83344
name: Teams User submissions daily trend
description: |
  This query visualises the daily amount of user false negative and false postive Teams message submissions
description-detailed: |
 This query visualises the daily amount of user false negative and false postive Teams message submissions
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  let baseQuery=CloudAppEvents
  | extend SubmissionType = tostring((parse_json(RawEventData)).SubmissionType),SubmissionContentType=tostring((parse_json(RawEventData)).SubmissionContentType)
  | where ActionType == "UserSubmission" and SubmissionContentType == "ChatMessage";
  let User_TeamsSubmission_FN_FP=baseQuery
  | make-series Count = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | extend Details = "User_TeamsSubmission_FN_FP";
  union User_TeamsSubmission_FN_FP
  | project Count, Details, Timestamp
  | render timechart
version: l.0.0

Required Data Sources

Sentinel TableNotes
CloudAppEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Microsoft Teams protection/Teams User submissions daily trend.yaml