Defender-MessageEvents

ActionType	Title	Sample	Rule
any	Teams message processed	N	Y

any: Teams message processed

Table: MessageEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`ThreadType`	2 detection rules	Kusto
`ThreatTypes`	1 detection rule	Kusto

Detection Patterns #

Defender-MessageEvents any: Teams message processedORDefender-MessageUrlInfo any: Teams message URL observed

2 rules

Kusto

Detect external user sending suspicious link to multiple users (source)

Robbe Van den Daele

Detect Malicious Teams Message (source)

Robbe Van den Daele

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`ThreadType` (kusto rule field)	eq	`chat`	2 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Detect Possible Teams BEC Attack by High Teams Recipients source: An external sender suddenly increasing the amount of internal users they are sending messages to, can indicate that external user being compromised and used for BEC Attacks. In these kind of attacks compromised accounts are used to send phishing links or attachments to users in business relationships.T1566

References #

Microsoft Defender XDR: advanced hunting reference