Defender-MessageEvents

ActionType	Title	Sample	Rule
any	Teams message processed	N	Y

any: Teams message processed

2 rules

Robbe Van den Daele

Robbe Van den Daele

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ThreadType` (kusto rule field)	eq	`chat`	2 rules	kusto

Detect Possible Teams BEC Attack by High Teams Recipients source: An external sender suddenly increasing the amount of internal users they are sending messages to, can indicate that external user being compromised and used for BEC Attacks. In these kind of attacks compromised accounts are used to send phishing links or attachments to users in business relationships.T1566