Hunting One On One Chats By Domains
Query
CloudAppEvents
| where Application has "Microsoft Teams" and isnotempty(IPAddress)
| extend Geo_IP = tostring(geo_info_from_ip_address(IPAddress).country)
| extend ChatName = todynamic(RawEventData).ChatName
| extend TeamName = todynamic(RawEventData).TeamName
| extend ChannelName = todynamic(RawEventData).ChannelName
| extend Operation = todynamic(RawEventData).Operation
| extend CommunicationType = todynamic(RawEventData).CommunicationType
| where Operation has "ChatCreated" and CommunicationType has "OneOnOne"
| mv-expand ParticipantsInfo = (todynamic(parse_json(RawEventData).ParticipantInfo))
| mv-expand ParticipatingDomains = (ParticipantsInfo).ParticipatingDomains
| mv-expand ParticipatingSIPDomains = (ParticipantsInfo).ParticipatingSIPDomains
| mv-expand ParticipatingSIPDomains = (ParticipatingSIPDomains).DomainName
| where Operation has "ChatCreated" and CommunicationType has "OneOnOne"
| where (ParticipatingDomains!="" or ParticipatingSIPDomains!="") and (ParticipatingDomains !in ("microsoft.com") or ParticipatingSIPDomains !in ("microsoft.com"))
| project AccountDisplayName,ChatCreatedFrom= IPAddress,ChannelName,ChatName, TeamName,Geo_IP, CountryCode,Operation,ParticipatingSIPDomains,ParticipatingDomains, ISPAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1566.003 | Phishing: Spearphishing via Service |
Author: Sergio Albea (05/03/2025)
Hunting OneOnOne chats by Domains
The following KQL query helps detect domains interacting with OneOnOne Teams Chats in your tenant, and allows to whitelist trusted or known domains while flagging suspicious ones.
Explanation
This KQL (Kusto Query Language) query is designed to monitor and analyze interactions within Microsoft Teams, specifically focusing on one-on-one chat sessions. Here's a simplified breakdown of what the query does:
-
Data Source: It starts by accessing the
CloudAppEventstable, which contains logs of cloud application activities. -
Filter for Teams Activity: The query filters the data to include only events related to Microsoft Teams where an IP address is present.
-
Extract Information: It extracts various details from the raw event data, such as the chat name, team name, channel name, operation type, and communication type.
-
Focus on One-on-One Chats: The query specifically looks for events where a chat was created and the communication type is "OneOnOne."
-
Expand Participant Information: It expands the participant information to list all domains involved in the chat, including both general and SIP (Session Initiation Protocol) domains.
-
Exclude Trusted Domains: The query excludes interactions involving the domain "microsoft.com" to focus on potentially suspicious or untrusted domains.
-
Output: Finally, it projects (selects) specific fields to display, such as the account display name, IP address from which the chat was created, channel name, chat name, team name, geographical IP information, operation type, and the participating domains.
In summary, this query helps identify and flag potentially suspicious domains interacting with one-on-one Microsoft Teams chats, while allowing trusted domains to be whitelisted.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques