Microsoft 365 Teams payload distribution
Executable or archive files uploaded into Teams repeatedly by one account.
What it detects
Executable or archive files uploaded into Teams repeatedly by one account.
Internal chat carries trust that email does not. A file arriving in a Teams channel from a colleague bypasses the scepticism a stranger's attachment would meet, and it bypasses the gateway that would have scanned that attachment. An account taken over inside the tenant is therefore a better delivery vehicle than any external sender, which is why lateral phishing moves to chat.
Keyed on file TYPE and repetition together: one .zip is a colleague sharing work, the same executable pushed into several conversations is distribution.
MITRE ATT&CK mapping
False positives and triage
Engineering and IT teams share builds, installers and archives in chat all day, and in a software company this rule will find them first — allowlist those channels or accounts rather than raising the threshold, because the count is not what distinguishes an attack here. Look at the SPREAD and the hour: a developer posts to their team's channel during the day, while distribution goes to several unrelated conversations, often out of hours, from an account with a recent suspicious sign-in. .lnk, .hta, .scr and .iso are worth more attention than .zip, which is genuinely common.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 65%. Source: rules/cloud/m365_teams_payload_distribution.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_teams_payload_distribution
version: 1.0.0
status: stable
severity: high
confidence: 0.65
platforms: [application]
mitre_techniques: [T1566.001, T1080]
description: |
Executable or archive files uploaded into Teams repeatedly by one account.
Internal chat carries trust that email does not. A file arriving in a Teams
channel from a colleague bypasses the scepticism a stranger's attachment would
meet, and it bypasses the gateway that would have scanned that attachment. An
account taken over inside the tenant is therefore a better delivery vehicle than
any external sender, which is why lateral phishing moves to chat.
Keyed on file TYPE and repetition together: one `.zip` is a colleague sharing
work, the same executable pushed into several conversations is distribution.
match:
provider: Office365
event_action_any:
- FileUploaded
raw_message_contains_any:
- ".exe"
- ".lnk"
- ".scr"
- ".iso"
- ".vbs"
- ".js"
- ".hta"
- ".zip"
threshold:
count: 3
window_seconds: 1800
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Engineering and IT teams share builds, installers and archives in chat all day,
and in a software company this rule will find them first — allowlist those
channels or accounts rather than raising the threshold, because the count is not
what distinguishes an attack here. Look at the SPREAD and the hour: a developer
posts to their team's channel during the day, while distribution goes to several
unrelated conversations, often out of hours, from an account with a recent
suspicious sign-in. `.lnk`, `.hta`, `.scr` and `.iso` are worth more attention
than `.zip`, which is genuinely common.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.