Detection : External User Added to Team and Immediately Uploads File

Detections/OfficeActivity/External User added to Team and immediately uploads file.yaml

@@ -0,0 +1,60 @@
+id: bff058b2-500e-4ae5-bb49-a5b1423cbd5b
+name: Accessed files shared by temporary external user
+description: |
+  'This detection identifies an external user is added to a Team or Teams chat
+  and shares a files which is accessed by many users (>10) and the users is removed within short period of time. This might be
+  an indicator of suspicious activity.'
+severity: Low
+requiredDataConnectors:
+  - connectorId: Office365
+    dataTypes:
+      - OfficeActivity (Teams)
+queryFrequency: 1h
+queryPeriod: 1h
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - InitialAccess
+relevantTechniques:
+  - T1566
+query: |
+ let fileAccessThrehold = 10;
+ OfficeActivity
+  | where OfficeWorkload =~ "MicrosoftTeams"
+  | where Operation =~ "MemberAdded"
+  | extend UPN = tostring(parse_json(Members)[0].UPN)
+  | where UPN contains ("#EXT#")
+  | project TimeAdded=TimeGenerated, Operation, UPN, UserWhoAdded = UserId, TeamName
+  | join kind = inner(
+                        OfficeActivity
+                        | where OfficeWorkload =~ "MicrosoftTeams"
+                        | where Operation =~ "MemberRemoved"
+                        | extend UPN = tostring(parse_json(Members)[0].UPN)
+                        | where UPN contains ("#EXT#")
+                        | project TimeDeleted=TimeGenerated, Operation, UPN, UserWhoDeleted = UserId, TeamName
+                      ) on UPN
+  | where TimeDeleted > TimeAdded
+  | join kind=inner 
+                    (
+                    OfficeActivity
+                    | where RecordType == "SharePointFileOperation"
+                    | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+                    | where Operation == "FileUploaded"
+                    | join kind = inner 
+                                        (
+                                        OfficeActivity
+                                        | where RecordType == "SharePointFileOperation"
+                                        | where Operation  == "FileAccessed"
+                                        | where SourceRelativeUrl has "Microsoft Teams Chat Files"
+                                        | summarize FileAccessCount = count() by OfficeObjectId
+                                        | where FileAccessCount > fileAccessThrehold
+                                        ) on $left.OfficeObjectId == $right.OfficeObjectId
+                    )on $left.UPN == $right.UserId
+  | extend timestamp=TimeGenerated, AccountCustomEntity = UserWhoAdded 
+entityMappings:
+  - entityType: Account
+    fieldMappings:
+      - identifier: FullName
+        columnName: AccountCustomEntity
+version: 1.0.0
+kind: Scheduled