ACSC Logo
© GEMXIT
GEMXIT Logo
Agent Foskett Investigation • Microsoft Defender XDR • Microsoft Teams • UrlClickEvents • CloudAppEvents • Entra ID • KQL

The Teams Message Contained the Phishing Link — Not the Email

The user reported a suspicious sign-in.

The security team searched the mailbox.

No phishing email.
No malicious attachment.
No suspicious message in the inbox.

For a moment, the incident had no delivery path.

Then Agent Foskett checked the click telemetry.

The phishing link had arrived through Microsoft Teams.

Discuss Microsoft security Back to investigations
Agent Foskett investigating a phishing link delivered through Microsoft Teams
Phishing Does Not Need an Inbox

Users receive links through collaboration platforms, chats and shared workspaces as well as email. The investigation has to follow the delivery channel the evidence actually shows.

✓ Find Teams URL clicks
✓ Reconstruct the delivery context
✓ Correlate the click with identity activity

The mailbox search came back clean

The user had clearly interacted with a suspicious URL, but the usual email investigation did not explain how it reached them. That was the first clue that the investigation had started in the wrong communication channel.
No phishing emailThe mailbox did not contain the message investigators expected to find.
A suspicious click existedURL telemetry showed that the user had still reached a suspicious destination.
The channel matteredThe click was associated with Microsoft Teams rather than email.

Start with Teams URL click telemetry

In Microsoft Defender XDR, UrlClickEvents can be used to investigate Safe Links click activity. Filtering the workload to Teams helps separate collaboration-platform clicks from email-based activity.
teams-url-clicks.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
UrlClickEvents
| where Timestamp > ago(7d)
| where Workload =~ "Teams"
| project Timestamp,
          AccountUpn,
          Url,
          ActionType,
          ThreatTypes,
          IsClickedThrough,
          IPAddress
| order by Timestamp desc

Follow the affected user

Once the account is known, narrow the Teams click history to that user. The URL, click action, threat classification and source IP help establish what the user interacted with and when.
user-teams-clicks.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
let User = "alex@contoso.com";
UrlClickEvents
| where Timestamp > ago(7d)
| where Workload =~ "Teams"
| where AccountUpn =~ User
| project Timestamp,
          Url,
          ActionType,
          ThreatTypes,
          IsClickedThrough,
          IPAddress
| order by Timestamp asc

The delivery path was Teams

The click record changed the investigation. The absence of a phishing email was no longer a mystery because email had never been the delivery mechanism. The attacker had used a collaboration channel the user already trusted during the working day.
10:18 — Teams activityThe suspicious URL appeared in the user's collaboration activity.
10:19 — URL clickedDefender recorded the user's interaction with the link.
10:24 — identity activity changedSign-in telemetry provided the next part of the timeline.

Search Teams activity for the suspicious domain

CloudAppEvents can provide additional Microsoft 365 activity context where the relevant telemetry is available. Searching the raw event data for the known domain can help locate related Teams activity without assuming a specific action type before the data is inspected.
teams-domain-context.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
let Domain = "contoso-secure-login.example";
CloudAppEvents
| where Timestamp > ago(7d)
| where Application =~ "Microsoft Teams"
| where tostring(RawEventData) has Domain
| project Timestamp,
          AccountDisplayName,
          AccountId,
          ActionType,
          IPAddress,
          RawEventData
| order by Timestamp asc

What happened after the click?

A phishing link becomes much more important when identity activity changes immediately afterwards. Pivot into Entra sign-in logs and look for new IP addresses, unusual locations, authentication results and Conditional Access outcomes around the same period.
post-click-signins.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
let User = "alex@contoso.com";
SigninLogs
| where TimeGenerated > ago(7d)
| where UserPrincipalName =~ User
| project TimeGenerated,
          UserPrincipalName,
          AppDisplayName,
          IPAddress,
          Location,
          ResultType,
          ResultDescription,
          ConditionalAccessStatus,
          AuthenticationRequirement
| order by TimeGenerated asc

Check the endpoint context

If the affected user has Defender for Endpoint telemetry, browser process activity can help identify which device was active during the incident window. Endpoint evidence does not prove the Teams message content by itself, but it can strengthen the timeline around the user's interaction.
browser-context.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
let User = "alex@contoso.com";
DeviceProcessEvents
| where Timestamp > ago(7d)
| where AccountUpn =~ User
| where FileName in~ ("msedge.exe", "chrome.exe")
| project Timestamp,
          DeviceName,
          AccountUpn,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName
| order by Timestamp asc

Correlate the click with the sign-in window

Instead of reviewing an entire day of sign-ins, take the first relevant Teams click and build a focused identity window around it. This makes the investigation easier to explain and reduces unrelated activity in the result set.
click-to-signin-window.kql
  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12
  13. 13
  14. 14
  15. 15
  16. 16
  17. 17
  18. 18
  19. 19
  20. 20
  21. 21
  22. 22
  23. 23
let User = "alex@contoso.com";
let ClickTime =
    toscalar(
        UrlClickEvents
        | where Timestamp > ago(7d)
        | where Workload =~ "Teams"
        | where AccountUpn =~ User
        | summarize min(Timestamp)
    );
SigninLogs
| where UserPrincipalName =~ User
| where TimeGenerated between
    ((ClickTime - 15m) .. (ClickTime + 60m))
| project TimeGenerated,
          UserPrincipalName,
          AppDisplayName,
          IPAddress,
          ResultType,
          ConditionalAccessStatus
| order by TimeGenerated asc

The attack crossed security boundaries

This incident did not live inside one Microsoft security product. The delivery clue came from Teams click telemetry, the account impact appeared in Entra sign-ins and endpoint evidence helped establish the device context.
Collaboration evidenceExplained how the suspicious link reached the user.
Identity evidenceShowed what happened to the account after the interaction.
Endpoint evidenceHelped place the user's device into the incident timeline.

What the evidence can and cannot prove

A Teams URL click can establish that the user interacted with a link through that workload. It does not automatically prove credential theft or account compromise. Those conclusions require supporting identity, session or endpoint evidence.
ProvenThe suspicious URL interaction was associated with the Teams workload.
CorrelatedIdentity activity occurred close enough to the click to justify deeper investigation.
Do not overclaimA click alone is not proof that credentials were entered or stolen.

Agent Foskett's investigation mindset

Do not let the word phishing automatically send the entire investigation into the mailbox. Modern users communicate through Teams, chat, shared documents and cloud applications all day. Follow the evidence to the actual delivery channel.
Do not assume emailStart with the interaction evidence when the delivery mechanism is unknown.
Follow the clickThe URL event can become the anchor point for the rest of the timeline.
Cross the productsCorrelate collaboration, identity and endpoint telemetry instead of investigating each in isolation.

Investigation findings

The mailbox contained no phishing message because the malicious link had not arrived by email. Defender URL click telemetry associated the interaction with Microsoft Teams. The click provided the pivot into Entra sign-in activity and endpoint context, allowing the incident to be reconstructed across collaboration, identity and device telemetry.
The inbox was cleanThat was accurate, but it did not mean the user had not been phished.
Teams contained the delivery clueThe workload associated with the click revealed the missing attack path.
The timeline connected the incidentClick, sign-in and endpoint evidence turned separate events into one investigation.

Related Agent Foskett investigations

Continue with phishing, identity and Microsoft 365 investigations.
The File Was Clean When It Arrived — It Became Malicious LaterSee why a familiar filename did not mean the content was still the same. Agent Foskett InvestigationsContinue through practical Microsoft security investigations built around evidence and timelines. Agent Foskett AcademyBuild practical Microsoft security investigation and KQL skills.
The inbox was clean because the attack never used the inbox.
Follow the delivery channel the telemetry proves — not the one you expected.
Continue the Investigation

Final thought

Phishing is a technique, not an email format. When a user reaches a malicious destination, the investigation should not stop because the mailbox is clean. Follow the URL interaction, identify the workload, correlate what happened to the identity afterwards and use endpoint evidence to complete the timeline. Sometimes the most important clue is not what you found in the inbox. It is the fact that the inbox was never involved.
Where was the link delivered?Use workload-aware telemetry instead of assuming email.
What happened after the click?Pivot into identity and session evidence.
Can the timeline be proved?Keep each conclusion tied to the telemetry that supports it.
Develop IT. Protect IT.
GEMXIT PTY LTD | GEMXIT UK LTD
Talk to GEMXIT
ACSC Logo

GEMXIT PTY LTD  |  GEMXIT UK LTD  |  © GEMXIT

The Teams Message Contained the Phishing Link — Not the Email

This Agent Foskett investigation explores Microsoft Teams phishing, Microsoft Defender XDR, UrlClickEvents, CloudAppEvents, Microsoft Entra sign-in telemetry and KQL.

Microsoft Teams Phishing Investigation

The investigation follows a suspicious URL interaction associated with the Teams workload and correlates the click with identity and endpoint activity.

Teams, Defender XDR, Entra ID And KQL

Phishing investigations should not assume email was the delivery channel. Collaboration telemetry can reveal how a malicious link reached the user and provide the pivot into the wider incident timeline.