Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Data Exfiltration via Microsoft Teams

Steven Lim@KQLWizard

•updated Jul 1, 2025•13•0•133

KQL Query from file: Data Exfiltration via Microsoft Teams

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1102.002 - Bidirectional Communication T1078 - Valid Accounts T1087.001 - Local Account TA0011 - Command and Control TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery TA0010 - Exfiltration T1567.004 - Exfiltration Over Webhook T1074 - Data Staged G0131 - Tonto Team G0034 - Sandworm Team G0130 - Ajax Security Team S0177 - Power Loader T1653 - Power Settings T1119 - Automated Collection T1137 - Office Application Startup TA0009 - Collection Data Exfiltration Email Sent Network Data Transfer Office 365 M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?