KQL Search

Query Details

HomeAI ToolsDevice Query

Detecting Teams Red Team Tool Convo C2

Query

// Detecting Teams Red Team Tool ConvoC2

// https://cybersecuritynews.com/red-team-tool-to-executes-commands-via-ms-teams/amp/

// DefendXDR Detection

CloudAppEvents
| where Timestamp > ago(1h)
| where Application == @"Microsoft Teams"
| where ActionType == @"AppInstalled"
| where parse_json(RawEventData)["AddOnName"] == 'Workflows'

Explanation

This KQL (Kusto Query Language) query is designed to detect a specific event related to Microsoft Teams within the last hour. Here's a simple breakdown:

  1. Data Source: The query is looking at CloudAppEvents, which is a log of events related to cloud applications.

  2. Time Frame: It filters events to only include those that occurred in the past hour (Timestamp > ago(1h)).

  3. Application Filter: It specifically focuses on events related to Microsoft Teams (Application == @"Microsoft Teams").

  4. Action Type: It looks for events where an application was installed (ActionType == @"AppInstalled").

  5. Specific Add-On: Finally, it checks if the installed add-on is named 'Workflows' by parsing the RawEventData to find the AddOnName.

In summary, this query is detecting if the 'Workflows' add-on was installed in Microsoft Teams within the last hour, which could be relevant for identifying potential use of a Red Team tool as described in the linked article.

Details

Steven Lim profile picture

Steven Lim

Released: December 11, 2024

Tables

CloudAppEvents

Keywords

CloudAppEventsMicrosoftTeamsAppInstalledWorkflows

Operators

ago()parse_json()where>==

Actions