Merge pull request #14707 from SlimKQL/new-mdo-queries

added a query to detect Teams impersonation attack

Author: v-atulyadav

Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Spoof and Impersonation/Helpdesk theme impersonation attack detection.yaml

@@ -0,0 +1,25 @@
+id: edd48210-532e-4560-a8fe-065240cd2f20
+name: Display Name - Helpdesk theme impersonation attack detection
+description: |
+  This query check the external Teams UPN against known Teams impersonation domain
+description-detailed: |
+  This query check the external Teams UPN against known Teams impersonation domain
+requiredDataConnectors:
+- connectorId: MicrosoftThreatProtection
+  dataTypes:
+  - CloudAppEvents
+tactics:
+  - InitialAccess
+relevantTechniques:
+  - T1566
+query: |
+  let HelpdeskDomain = dynamic(["helpdesk-quick.com","helpdesk-call.com","helpdesk-service.com"]);
+  CloudAppEvents
+  | where Timestamp > ago(30d)
+  | where ActionType == "TeamsImpersonationDetected"
+  | extend ImpersonationDisplayName = tostring(parse_json(tostring(RawEventData.Sender)).DisplayName)
+  | extend ImpersonationUPN = tostring(parse_json(tostring(RawEventData.Sender)).UPN)
+  | extend ImpactedUserUPN = tostring(RawEventData.UserId)
+  | where ImpersonationUPN has_any(HelpdeskDomain)
+  | project Timestamp, AccountType, ImpactedUserUPN, ImpersonationDisplayName, ImpersonationUPN
+version: 1.0.0