In recent years, there has been a noticeable increase in malicious activity involving hackers leveraging Microsoft Teams as an attack vector. Threat actors from external domains initiate one-on-one chats with users within our organization, impersonating support teams or other trusted entities. Their goal is to establish credibility and deceive employees into engaging with them.
These attackers often send files or emails under the guise of providing assistance, but in reality, they aim to deliver malicious payloads. This can include malware infections, phishing attempts, or even remote desktop (RDP) connections, which allow them to steal sensitive data, compromise credentials, or gain persistent access to corporate environments.
There are various Indicators of Compromise (IOCs) and pieces of intelligence that we can extract to gain deeper insights into one-on-one chats or ChatCreated events. Each of these elements provides valuable context for detecting potential threats, identifying malicious activity, and enhancing security monitoring.
Let’s analyze them one by one, focusing on how they can help in cyber threat detection, incident response, and proactive defense.
Hunting OneOnOne chats by Domains
If your tenant allows external communication from any domain (not just internal or federated ones), it is crucial to monitor and identify who is initiating external conversations within your environment.
The following KQL query helps detect external domains interacting with your tenant, and allows to whitelist trusted or known domains while flagging suspicious ones.
From a cybersecurity perspective, I strongly recommend configuring an alert-based detection rule to trigger notifications whenever an unknown domain initiates a One-on-One chat. This can help prevent social engineering attacks, phishing attempts, and malware delivery via Teams — a technique increasingly leveraged by attackers to impersonate IT support or trusted personnel.
CloudAppEvents
| where Application has “Microsoft Teams” and isnotempty(IPAddress)
| extend Geo_IP = tostring(geo_info_from_ip_address(IPAddress).country)
| extend ChatName = todynamic(RawEventData).ChatName
| extend TeamName = todynamic(RawEventData).TeamName
| extend ChannelName = todynamic(RawEventData).ChannelName
| extend Operation = todynamic(RawEventData).Operation
| extend CommunicationType = todynamic(RawEventData).CommunicationType
| where Operation has “ChatCreated” and CommunicationType has “OneOnOne”
| mv-expand ParticipantsInfo = (todynamic(parse_json(RawEventData).ParticipantInfo))
| mv-expand ParticipatingDomains = (ParticipantsInfo).ParticipatingDomains
| mv-expand ParticipatingSIPDomains = (ParticipantsInfo).ParticipatingSIPDomains
| mv-expand ParticipatingSIPDomains = (ParticipatingSIPDomains).DomainName
| where Operation has “ChatCreated” and CommunicationType has “OneOnOne”
| where (ParticipatingDomains!=“” or ParticipatingSIPDomains!=“”) and (ParticipatingDomains !in (“microsoft.com”) or ParticipatingSIPDomains !in (“microsoft.com”))
| project AccountDisplayName,ChatCreatedFrom= IPAddress,ChannelName,ChatName, TeamName,Geo_IP, CountryCode,Operation,ParticipatingSIPDomains,ParticipatingDomains, ISP
Hunting Malicious OneOnOne chats by URL
One common tactic used by hackers when contacting users remotely via Microsoft Teams is to share malicious URLs, tricking victims into accessing and downloading harmful content. These URLs often lead to malware, phishing sites, or remote access tools designed to compromise systems.
In this case, the query retrieves a list of actively tracked malicious URLs from the UrlHaus database, a well-known threat intelligence source that monitors and reports malicious domains used in cyberattacks.
By leveraging this query, you can proactively detect whether any known malicious URLs have been shared through Microsoft Teams conversations. This helps identify potential phishing attempts, malware distribution, or other cyber threats attempting to infiltrate the organization via social engineering.
//UrlHaus Abuse.ch Hits in Microsoft Teams
let URLHausOnlineRAW = externaldata (UHFeed:string) [“https://urlhaus.abuse.ch/downloads/csv_online/”] with(format=“txt”)
| where UHFeed !startswith “#”
| extend UHRAW=replace_string(UHFeed, ‘"’, ‘’)
| project splitted=split(UHRAW, ‘,’)
| mv-expand id=splitted[0], dateadded=splitted[1], UHUrl=splitted[2], UHurl_status=splitted[3], UHlast_onlin=splitted[4], UHthreat=splitted[5], UHtags=splitted[6], UHLink=splitted[7], UHReporter=splitted[8]
| extend UHUrl = tostring(UHUrl);
CloudAppEvents
| where Application has “Microsoft Teams”
| extend MessageURLs = tostring(todynamic(RawEventData).MessageURLs)
| extend MessageURLs_ = substring(MessageURLs, 2, strlen(MessageURLs) - 4)
| join kind=inner URLHausOnlineRAW on $left.MessageURLs_ == $right.UHUrl
Hunting Malicious OneOnOne chats by IP
Another effective method to identify who is initiating these One-to-One chats is by analyzing their IP address. You can leverage your preferred threat intelligence sources to cross-check these IPs against known malicious indicators.
One useful resource is IPsum, a threat intelligence feed aggregating multiple public lists of suspicious and malicious IP addresses. By correlating the chat initiator’s IP with such feeds, you can detect if a potentially risky or compromised IP is attempting to engage in direct communication with users in your Microsoft Teams tenant.
let ipsumrawData = externaldata(ip_string: string)[h@“https://raw.githubusercontent.com/stamparm/ipsum/master/ipsum.txt”] with (format=“txt”);
CloudAppEvents
| where Application has “Microsoft Teams” and isnotempty(IPAddress)
| extend Geo_IP = tostring(geo_info_from_ip_address(IPAddress).country)
| extend ChatName = todynamic(RawEventData).ChatName
| extend TeamName = todynamic(RawEventData).TeamName
| extend ChannelName = todynamic(RawEventData).ChannelName
| extend Operation = todynamic(RawEventData).Operation
| extend CommunicationType = todynamic(RawEventData).CommunicationType
| extend MessageURLs = tostring(todynamic(RawEventData).MessageURLs)
| where Operation has “ChatCreated” and CommunicationType has “OneOnOne”
| join kind=inner ( ipsumrawData) on $left.IPAddress == $right.ip_string
| project ActionType, Operation, AccountDisplayName, ChatCreatedFrom= IPAddress,Geo_IP, CountryCode,ChatName, CommunicationType
Mitigation
When possible, the best option to mitigate these threats, is to enforce strict external communication policies, and educate employees on social engineering tactics.
In addition, continuous monitoring of Teams activity, including external message patterns and file transfers, can help identify suspicious behavior before it leads to a security breach or potential threat.
Hunting malicious OneOnOne chats via MS Teams was originally published in Detect FYI on Medium, where people are continuing the conversation by highlighting and responding to this story.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Article Link: Hunting malicious OneOnOne chats via MS Teams | by Sergio Albea | Apr, 2025 | Detect FYI