Defender-MessageEvents

any: Teams message processed

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table: MessageEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`ThreadType`	2 detection rules	Kusto
`ThreatTypes`	1 detection rule	Kusto

Detection Patterns #

Defender-MessageEvents any: Teams message processedORDefender-MessageUrlInfo any: Teams message URL observed

2 rules

Kusto

Detect external user sending suspicious link to multiple users (source)

Robbe Van den Daele

Detect Malicious Teams Message (source)

Robbe Van den Daele

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

Detect Possible Teams BEC Attack by High Teams Recipients source: An external sender suddenly increasing the amount of internal users they are sending messages to, can indicate that external user being compromised and used for BEC Attacks. In these kind of attacks compromised accounts are used to send phishing links or attachments to users in business relationships.T1566

References #

Microsoft Defender XDR: advanced hunting reference