Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detecting External Microsoft Teams Spray

Steven Lim@KQLWizard

•updated Jul 1, 2025•18•1•165

KQL Query from file: Detecting External Microsoft Teams Spray

Microsoft Sentinel (KQL)

Tags

G0131 - Tonto Team G0034 - Sandworm Team G0130 - Ajax Security Team T1593.001 - Social Media T1586.001 - Social Media Accounts T1585.001 - Social Media Accounts S1139 - INC Ransomware S1180 - BlackByte Ransomware S1181 - BlackByte 2.0 Ransomware S1070 - Black Basta G1046 - Storm-1811 S0389 - JCry T1566.001 - Spearphishing Attachment T1566.002 - Spearphishing Link T1566 - Phishing T1078 - Valid Accounts T1204.002 - Malicious File T1534 - Internal Spearphishing T1059 - Command and Scripting Interpreter T1059.003 - Windows Command Shell T1566.003 - Spearphishing via Service TA0043 - Reconnaissance TA0042 - Resource Development TA0001 - Initial Access TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0002 - Execution TA0008 - Lateral Movement Email Phishing Detected Application Event Network Connection Office 365 M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?