Detect Malicious Teams Message

This detection rule detects Microsoft Teams messages where MDO detected a threat in the message.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566.002` Phishing: Spearphishing Link
Execution	`T1204.001` User Execution: Malicious Link

Platform	Record / event type
Microsoft Defender for Endpoint	`MessageEvents` action `any`: Teams message processed
Microsoft Defender for Endpoint	`MessageUrlInfo` action `any`: Teams message URL observed

// Malicious messages detection
MessageEvents
| where ThreatTypes != ""
| join kind=leftouter MessageUrlInfo on TeamsMessageId

MessageEvents

| where ThreatTypes != ""

| join kind=leftouter MessageUrlInfo on TeamsMessageId