T1534

Internal Spearphishing

Lateral Movement Last updated:

Adversaries who have already compromised an account or system may abuse the trusted internal identity to send phishing messages to other users within the same organization. Because the message originates from a known colleague, recipients are far more likely to open attachments, click links, or provide credentials. Campaigns typically combine a compromised mailbox or chat account with a weaponized attachment, a credential-harvesting link, or a malicious macro-enabled document. Real-world actors include Gamaredon (Outlook VBA module auto-sending phishing to contacts), Kimsuky (stolen credentials reused for internal mail), Leviathan/APT40, and HEXANE. Detection surfaces include anomalous send volume or recipient patterns from an internal account, Outlook spawning suspicious child processes (macro execution), Microsoft Teams delivering external URLs or files, and mass-BCC or reply-all abuse patterns.

What is T1534 Internal Spearphishing?

Internal Spearphishing (T1534) maps to the Lateral Movement tactic — the adversary is trying to move through your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Internal Spearphishing, covering the data sources and telemetry it touches: Process: Process Creation, Application Log: Office 365 Audit Logs, Network Traffic: Network Connection Creation, Microsoft Defender for Endpoint, Microsoft 365 OfficeActivity. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Lateral Movement
Technique
T1534 Internal Spearphishing
Canonical reference
https://attack.mitre.org/techniques/T1534/
Microsoft Sentinel / Defender
kusto 
// --- Signal 1: Outlook spawning suspicious child processes (VBA macro execution)
let OutlookMacroParents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "outlook.exe"
| where FileName in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe",
    "bitsadmin.exe", "msiexec.exe", "wmic.exe", "curl.exe", "wget.exe"
  )
| extend Signal = "OutlookMacroChildProcess"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// --- Signal 2: Anomalous internal email send volume (Office 365 OfficeActivity)
let HighVolumeSend = OfficeActivity
| where TimeGenerated > ago(24h)
| where Operation == "Send"
| where UserId !endswith "#EXT#"
| extend SenderDomain = tostring(split(UserId, "@")[1])
| summarize EmailsSent=count(), UniqueRecipients=dcount(tostring(Parameters)),
            FirstSend=min(TimeGenerated), LastSend=max(TimeGenerated)
  by UserId, SenderDomain, bin(TimeGenerated, 1h)
| where EmailsSent > 20
| extend Signal = "HighVolumeInternalSend"
| project TimeGenerated=FirstSend, UserId, SenderDomain, EmailsSent, UniqueRecipients, Signal;
// --- Signal 3: Teams messages containing suspicious external links
let TeamsSuspiciousLinks = OfficeActivity
| where TimeGenerated > ago(24h)
| where RecordType == "MicrosoftTeams"
| where Operation in ("MessageCreatedHasLink", "MessageUpdatedHasLink", "MessagesListed")
| where isnotempty(tostring(ExtraProperties))
| extend MsgContent = tostring(ExtraProperties)
| where MsgContent has_any (
    "http://", "https://",
    ".zip", ".exe", ".lnk", ".iso", ".vbs", ".js", ".hta"
  )
| where MsgContent !has "microsoft.com" and MsgContent !has "sharepoint.com"
        and MsgContent !has "teams.microsoft.com"
| extend Signal = "TeamsSuspiciousLinkOrFile"
| project TimeGenerated, UserId, ClientIP, MsgContent, Signal;
// --- Union all signals
OutlookMacroParents
| union kind=outer (HighVolumeSend | project Timestamp=TimeGenerated, DeviceName="", AccountName=UserId,
  FileName="", ProcessCommandLine=strcat("EmailsSent:", tostring(EmailsSent)), 
  InitiatingProcessFileName="OfficeActivity", InitiatingProcessCommandLine="", Signal)
| union kind=outer (TeamsSuspiciousLinks | project Timestamp=TimeGenerated, DeviceName="",
  AccountName=UserId, FileName="", ProcessCommandLine=MsgContent,
  InitiatingProcessFileName="TeamsActivity", InitiatingProcessCommandLine="", Signal)
| sort by Timestamp desc

Three-signal detection for internal spearphishing activity using Microsoft Defender for Endpoint and Microsoft 365 OfficeActivity logs. Signal 1 catches Gamaredon-style Outlook VBA macros by detecting Outlook spawning LOLBins or script interpreters. Signal 2 identifies anomalous send volume (>20 emails/hour from a single internal account) indicative of a compromised mailbox mass-sending phishing lures. Signal 3 detects Microsoft Teams messages containing external hyperlinks or executable file extensions from internal users — a documented technique used by Midnight Blizzard/Cozy Bear. All three signals are unioned and sorted by time for analyst review.

high severity medium confidence

Data Sources

Process: Process Creation Application Log: Office 365 Audit Logs Network Traffic: Network Connection Creation Microsoft Defender for Endpoint Microsoft 365 OfficeActivity

Required Tables

DeviceProcessEvents OfficeActivity

False Positives

  • Legitimate marketing or HR mass-email campaigns using a shared internal account that sends newsletters or announcements to all staff
  • Automated IT notification systems (monitoring alerts, ticketing systems, patch notifications) sending bulk emails from a service account
  • Outlook VBA macros used by finance or legal teams for legitimate templated document workflows spawning cmd.exe or wscript.exe
  • IT administrators sending automated onboarding emails via PowerShell scripts authenticated as their own account
  • Microsoft Teams bots or connectors posting messages with external links as part of approved integrations (e.g., GitHub notifications, JIRA updates)

Sigma rule & cross-platform mapping

The detection logic for Internal Spearphishing (T1534) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1534 Sigma rules on detection.fyi

Platform-specific guides for T1534

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-20 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Outlook VBA Macro Auto-Send (Simulated Gamaredon Pattern)

    Expected signal: Sysmon Event ID 1: powershell.exe spawned with Outlook COM object instantiation. OfficeActivity O365 log: Operation=Send from the test account. If Outlook is running, Sysmon Event ID 10 (ProcessAccess) may show PowerShell accessing the Outlook process. Exchange/O365 message trace will record the outbound message.

  2. Test 2Write Malicious Macro to Outlook VbaProject.OTM

    Expected signal: Sysmon Event ID 11 (File Create): file creation event for the test artifact in %TEMP%. Sysmon Event ID 1: powershell.exe with path references to VbaProject.OTM. If Outlook is running and VbaProject.OTM is actually modified, Sysmon will log file modification events against the OTM path.

  3. Test 3Microsoft Teams Message with External Link (Simulated via Graph API)

    Expected signal: O365 OfficeActivity: RecordType=MicrosoftTeams, Operation=MessageCreatedHasLink, with the external URL in ExtraProperties. Azure AD sign-in log entry for the Graph API token use. Microsoft Defender for Cloud Apps (MCAS) may generate an alert for 'Suspicious inbox forwarding' or 'Unusual file share' depending on policy.

  4. Test 4Simulate Compromised Account Bulk Send via PowerShell Exchange Online

    Expected signal: O365 Unified Audit Log: multiple Send operations from [email protected] within a short window. Exchange message trace: batch of outbound messages with identical subject. Azure AD: interactive authentication event for the PowerShell connection. OfficeActivity table in Sentinel: Operation=Send entries for each recipient.

Response Playbook

Triage

  1. Identify the sending account — is the user currently active at their workstation, traveling, or on leave? Check AzureAD SigninLogs for recent authentication events including source IP and device compliance to determine if the account appears compromised
  2. For Outlook macro signals: examine the full parent-child process chain — what did the child process do? Check Sysmon Event ID 3 (network connection) and Event ID 11 (file creation) from the same process for download cradles or payload drops
  3. For high-volume send signals: retrieve a sample of the email subjects and recipient list from the Office 365 audit log or Exchange message tracking logs — do the messages contain attachments or links? Are recipients internal only, or does the campaign include external targets?
  4. For Teams link signals: attempt to visit the flagged URL in an isolated browser or sandbox — is it a credential harvesting page, a payload download, or a legitimate site? Check URLhaus or VirusTotal via API for reputation
  5. Check the user's recent authentication history for impossible travel (sign-in from two geographically distant IPs within minutes), unfamiliar device enrollments, or MFA fatigue events (multiple MFA push denials followed by an approval)
  6. Query whether any recipients of the suspicious internal messages have subsequently visited external URLs or downloaded files — use OfficeActivity and DeviceFileEvents to detect downstream victims of the campaign

Containment

  1. If account compromise is confirmed: immediately disable the account in Azure AD and revoke all active sessions using the 'Revoke sign-in sessions' function — this invalidates refresh tokens, Exchange ActiveSync tokens, and OAuth grants
  2. Reset the user's password and require re-enrollment of MFA factors, as the adversary may have registered a backdoor authenticator app or phone number
  3. If Outlook VBA macro execution is confirmed: isolate the endpoint using EDR network isolation or quarantine, then disable macro execution via Group Policy (Trust Center > Macro Settings > Disable all macros without notification) for the affected OU
  4. Block the malicious URLs or domains identified in the phishing messages at the secure web gateway, DNS resolver, and Safe Links policy in Microsoft Defender for Office 365
  5. Send an urgent internal notification to all recipients of the phishing campaign instructing them not to click links or open attachments from the compromised account, and to report if they already did
  6. If Teams was used for delivery: use the Microsoft Teams Admin Center to retract the malicious messages using the message moderation API or Teams eDiscovery compliance tools
  7. Place the compromised mailbox in litigation hold before disabling to preserve forensic evidence for the investigation

Evidence Collection

  1. Office 365 Unified Audit Log: search for all Send, MessageCreated, and FileAccessed operations by the compromised account for the 72 hours prior to detection — export via Compliance Center or Get-AuditLogSearch PowerShell
  2. Exchange Message Tracking Logs (on-premises) or Exchange Online Message Trace: pull the full delivery status, recipient list, and attachment hashes for all outbound messages from the suspected account
  3. Azure AD Sign-In Logs: export all authentication events for the compromised UPN including IP addresses, user agent strings, device IDs, conditional access results, and MFA outcomes
  4. Sysmon Event ID 1 (Process Create), 3 (Network Connection), 11 (File Create), and 7 (Image Load) from the affected endpoint for the Outlook process and all child processes
  5. Outlook VBA macro files at %APPDATA%\Microsoft\Templates\Normal.dotm and %APPDATA%\Microsoft\Outlook\VbaProject.OTM — these are the persistence locations for Gamaredon-style Outlook macros
  6. Windows Event ID 4648 (Logon with explicit credentials) and 4624 (successful logon) from the affected host during the incident window
  7. Any files dropped to %TEMP%, %APPDATA%, or startup directories by Outlook child processes — collect hashes and submit to sandbox for analysis
  8. Microsoft Teams chat export via eDiscovery or the Teams Export API to preserve the full message thread including URLs and any file attachments sent by the compromised account

Escalation Criteria

  • ! Any confirmed downstream infection — if a recipient of the internal phishing opened an attachment or clicked a link and subsequently ran a suspicious process, escalate immediately as the campaign has achieved lateral movement
  • ! Outlook VBA macro confirmed active and persisted in VbaProject.OTM — indicates the endpoint has been prepared as a phishing relay node, which is characteristic of Gamaredon and similar APT tooling
  • ! Compromised account has privileged access (Global Admin, Exchange Admin, Security Admin, Domain Admin) — the blast radius of internal spearphishing from a privileged account is catastrophically larger
  • ! Evidence of reconnaissance activity by the compromised account prior to the phishing campaign (e.g., enumerating contacts, querying staff directories, accessing org chart documents) — indicates deliberate targeting rather than opportunistic spam
  • ! Multiple internal accounts compromised or showing anomalous send behavior simultaneously — possible password spray followed by coordinated internal phishing wave
  • ! Malicious URLs in phishing messages resolve to known APT infrastructure, active C2 domains, or sites hosting signed malware — escalate to threat intelligence team and consider notifying CISA/sector ISAC

Investigation Guide

Forensic Artifacts

  • > File System: %APPDATA%\Microsoft\Outlook\VbaProject.OTM — Outlook VBA project file; Gamaredon stores its phishing macro here. Presence of unexpected code is a strong IOC
  • > File System: %APPDATA%\Microsoft\Templates\Normal.dotm — Word VBA template; check for macros that auto-run on document open or send mail via Outlook object model
  • > Registry: HKCU\SOFTWARE\Microsoft\Office\<version>\Outlook\Security — TrustAllFiles, Level2Delete, and DisableOOMWarnings values manipulated to suppress security prompts during macro-based mail sending
  • > Windows Event ID 4648 — Logon with explicit credentials — may indicate pass-the-hash or credential reuse from a different host to access the victim's mailbox
  • > Office 365 Unified Audit Log: RecordType=SendAs or RecordType=SendOnBehalf operations — indicates delegate access or impersonation rather than the account owner sending directly
  • > Microsoft Teams: TeamsClient local database at %APPDATA%\Microsoft\Teams\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb — contains cached message history including sent phishing messages before they were retracted
  • > Browser artifacts: saved credentials in Chrome/Edge credential store, cookies for O365/OWA sessions — may reveal stolen session tokens used to access a mailbox without password
  • > Exchange Online: MailItemsAccessed audit operation showing which folder items were accessed just before the mass-send event — confirms adversary reconnaissance of contacts prior to phishing

Tuning Guidance

Internal spearphishing detections require careful baselining to avoid drowning in false positives from legitimate bulk-mail workflows. Start by building an allowlist of service accounts known to send high volumes: HR announcement accounts, IT notification mailboxes, ticketing systems, and monitoring alert senders. For Outlook macro child-process signals, inventory legitimate business macros that spawn cmd.exe or wscript.exe (finance templates, mail-merge scripts) and create process hash or parent command-line exclusions. For Teams link signals, build an approved-domain list from your organization's software catalog and extend the exclusion list accordingly. Tune the volume threshold for the high-send signal based on your environment's baseline — in large organizations 20/hour may be too low; raise to 50 or add a recipient diversity check. Correlating with Azure AD Identity Protection risk signals is strongly recommended: a high-volume send from an account with a 'medium' or 'high' risk score is a near-certain indicator of compromise vs. the same volume from an account with no risk events. For Teams, prioritize signals where the sending account also has recent anomalous sign-in activity.

Hunting Queries

Hunt for internal accounts sending to an unusually high number of distinct email domains over 7 days. Legitimate users rarely send to >5 unique domains per week; mass-spearphishing campaigns or compromised accounts relaying spam show high domain diversity. Joining with risky sign-in events surfaces accounts with both anomalous mail behavior and identity risk signals.

Hunting — KQL
kql 
// Hunt: Internal accounts with abnormal recipient diversity — many unique domains in outbound email
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation == "Send"
| extend Recipients = tostring(Parameters)
| extend RecipientDomains = extract_all(@"@([\w.-]+)", Recipients)
| mv-expand RecipientDomain = RecipientDomains to typeof(string)
| summarize UniqueDomains=dcount(RecipientDomain), TotalSent=count(),
            Domains=make_set(RecipientDomain, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
  by UserId
| where TotalSent > 10 and UniqueDomains > 5
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated > ago(7d)
    | where RiskLevelDuringSignIn in ("medium", "high")
    | summarize RiskySignins=count() by UserPrincipalName
  ) on $left.UserId == $right.UserPrincipalName
| sort by TotalSent desc
Hunting — SPL
spl 
index=o365 sourcetype="o365:management:activity" Operation="Send" earliest=-7d
| rex field=Parameters max_match=100 "@(?<RecipientDomain>[\w.-]+)"
| stats count as TotalSent, dc(RecipientDomain) as UniqueDomains,
        values(RecipientDomain) as Domains, earliest(_time) as FirstSeen, latest(_time) as LastSeen
  by UserId
| where TotalSent > 10 AND UniqueDomains > 5
| sort - TotalSent

Hunt for Outlook.exe making outbound network connections to non-Microsoft public IPs. Outlook should only connect to Microsoft/O365 infrastructure for legitimate mail operations. Connections to arbitrary external hosts from outlook.exe strongly indicate VBA macro execution performing C2 callbacks or payload downloads — a core Gamaredon and TA416 TTPs.

Hunting — KQL
kql 
// Hunt: Outlook spawning network connections to non-Microsoft external IPs (macro C2 or payload fetch)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "outlook.exe"
| where RemoteIPType == "Public"
| where RemoteUrl !has "microsoft.com" and RemoteUrl !has "office.com"
        and RemoteUrl !has "office365.com" and RemoteUrl !has "windows.com"
        and RemoteUrl !has "mimecast.com" and RemoteUrl !has "proofpoint.com"
| summarize Connections=count(), UniqueIPs=dcount(RemoteIP), Ports=make_set(RemotePort),
            URLs=make_set(RemoteUrl, 10), FirstSeen=min(Timestamp)
  by DeviceName, AccountName
| where UniqueIPs > 0
| sort by Connections desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  Image="*\\outlook.exe" earliest=-7d
  NOT (DestinationHostname="*.microsoft.com" OR DestinationHostname="*.office.com"
       OR DestinationHostname="*.office365.com" OR DestinationHostname="*.windows.com")
  NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*")
| stats count as Connections, dc(DestinationIp) as UniqueIPs,
        values(DestinationPort) as Ports, values(DestinationHostname) as Hostnames
  by host, User, Image
| where UniqueIPs > 0
| sort - Connections

Hunt for the reconnaissance-then-phish pattern: accounts that perform heavy mailbox reading followed within 2 hours by a bulk send campaign. This mirrors documented APT behavior where the adversary first reads contacts and recent conversations to craft convincing lures, then leverages that intelligence for targeted internal spearphishing.

Hunting — KQL
kql 
// Hunt: Accounts that read mail then immediately sent bulk messages — reconnaissance-then-phish pattern
let MailRead = OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in ("MailItemsAccessed", "FolderBind")
| summarize ReadEvents=count(), ReadStart=min(TimeGenerated) by UserId;
let MailSend = OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation == "Send"
| summarize SendCount=count(), SendStart=min(TimeGenerated) by UserId;
MailRead
| join kind=inner MailSend on UserId
| where SendCount > 15
| where datetime_diff("minute", SendStart, ReadStart) between (0 .. 120)
| project UserId, ReadEvents, ReadStart, SendCount, SendStart,
         MinutesToFirstSend=datetime_diff("minute", SendStart, ReadStart)
| sort by SendCount desc
Hunting — SPL
spl 
index=o365 sourcetype="o365:management:activity"
  (Operation="MailItemsAccessed" OR Operation="FolderBind" OR Operation="Send") earliest=-7d
| eval EventType=case(
    Operation="Send", "send",
    true(), "read"
  )
| stats count as EventCount, earliest(_time) as FirstEvent
  by UserId, EventType
| eval FirstEvent=strftime(FirstEvent, "%Y-%m-%dT%H:%M:%S")
| stats values(eval(if(EventType="read",EventCount,null()))) as ReadEvents,
        values(eval(if(EventType="send",EventCount,null()))) as SendCount,
        values(eval(if(EventType="read",FirstEvent,null()))) as ReadStart,
        values(eval(if(EventType="send",FirstEvent,null()))) as SendStart
  by UserId
| where SendCount > 15
| sort - SendCount

Atomic Red Team Tests

Test 1 Outlook VBA Macro Auto-Send (Simulated Gamaredon Pattern)
windows

Simulates the Gamaredon Group technique of installing a VBA macro in Outlook's VbaProject.OTM that automatically sends phishing emails to contacts. This test creates a benign macro that sends a test message to a specified internal address. Requires Outlook to be installed and a mail profile configured. Run in an isolated test environment only.

Command

powershell 
powershell.exe -Command "
$outlook = New-Object -ComObject Outlook.Application;
$mail = $outlook.CreateItem(0);
$mail.To = '[email protected]';
$mail.Subject = 'T1534 Atomic Test - Internal Spearphish Simulation';
$mail.Body = 'This is an authorized atomic test for T1534 Internal Spearphishing detection validation.';
$mail.Send();
Write-Output 'Mail sent via Outlook COM object'"

Cleanup

powershell 
No persistent changes. The sent email will appear in the Sent Items folder and can be deleted manually.

Expected Telemetry

Sysmon Event ID 1: powershell.exe spawned with Outlook COM object instantiation. OfficeActivity O365 log: Operation=Send from the test account. If Outlook is running, Sysmon Event ID 10 (ProcessAccess) may show PowerShell accessing the Outlook process. Exchange/O365 message trace will record the outbound message.

Expected Detection

KQL Signal 1 fires if PowerShell is a child of outlook.exe (adjust if COM launch differs). KQL Signal 2 fires if multiple test emails are sent. O365 audit Send operation logged and correlates with HighVolumeInternalSend if threshold is met.

Test 2 Write Malicious Macro to Outlook VbaProject.OTM
windows

Drops a VBA macro module to Outlook's VbaProject.OTM file — the same persistence mechanism used by Gamaredon Group to maintain phishing capability across reboots. The macro content in this test is benign (a MsgBox) but the artifact creation pattern is what the detection targets. This simulates the initial persistence stage before the mass-send phase.

Command

powershell 
powershell.exe -Command "
$vbaPath = "$env:APPDATA\Microsoft\Outlook\VbaProject.OTM";
$backupPath = "$env:TEMP\VbaProject.OTM.bak";
if (Test-Path $vbaPath) { Copy-Item $vbaPath $backupPath };
$macroComment = '-- T1534 Atomic Test Marker --';
Write-Output $macroComment | Out-File -Append "$env:TEMP\t1534_vba_test.txt";
Write-Output "VbaProject.OTM path: $vbaPath" | Out-File -Append "$env:TEMP\t1534_vba_test.txt";
Write-Output 'Artifact created at $env:TEMP\t1534_vba_test.txt'"

Cleanup

powershell 
Remove-Item $env:TEMP\t1534_vba_test.txt -ErrorAction SilentlyContinue; Remove-Item $env:TEMP\VbaProject.OTM.bak -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (File Create): file creation event for the test artifact in %TEMP%. Sysmon Event ID 1: powershell.exe with path references to VbaProject.OTM. If Outlook is running and VbaProject.OTM is actually modified, Sysmon will log file modification events against the OTM path.

Expected Detection

File creation or modification of VbaProject.OTM path should be caught by file integrity monitoring or custom Sysmon file creation rules targeting %APPDATA%\Microsoft\Outlook\VbaProject.OTM. The KQL Outlook macro child-process signal will fire if outlook.exe is subsequently used to run the macro.

Test 3 Microsoft Teams Message with External Link (Simulated via Graph API)
windows

Sends a Microsoft Teams message containing an external URL from an authenticated account using the Microsoft Graph API — simulating an adversary who has compromised a Teams account and is distributing phishing links via internal chat. Requires an app registration with Chat.ReadWrite delegated permissions or a test user's credentials. Replace placeholders with actual test values.

Command

powershell 
# Prerequisites: az CLI or Graph token available. Replace TEAM_ID, CHANNEL_ID, and TOKEN.
powershell.exe -Command "
$token = 'YOUR_GRAPH_ACCESS_TOKEN';
$teamId = 'YOUR_TEST_TEAM_ID';
$channelId = 'YOUR_TEST_CHANNEL_ID';
$body = @{
  body = @{
    contentType = 'text'
    content = 'T1534 Detection Test: Please review this document http://testphishinglink.example.com/login'
  }
} | ConvertTo-Json -Depth 5;
Invoke-RestMethod -Uri "https://graph.microsoft.com/v1.0/teams/$teamId/channels/$channelId/messages" -Method POST -Headers @{Authorization="Bearer $token"; 'Content-Type'='application/json'} -Body $body;
Write-Output 'Teams message with external link sent'"

Cleanup

powershell 
Delete the test message via Teams UI or Graph API DELETE /teams/{teamId}/channels/{channelId}/messages/{messageId}

Expected Telemetry

O365 OfficeActivity: RecordType=MicrosoftTeams, Operation=MessageCreatedHasLink, with the external URL in ExtraProperties. Azure AD sign-in log entry for the Graph API token use. Microsoft Defender for Cloud Apps (MCAS) may generate an alert for 'Suspicious inbox forwarding' or 'Unusual file share' depending on policy.

Expected Detection

KQL Signal 3 and SPL Teams subsearch fire on Operation=MessageCreatedHasLink with non-Microsoft domain URL. The domain testphishinglink.example.com will match the external link filter since it does not match the Microsoft-domain exclusion list.

Test 4 Simulate Compromised Account Bulk Send via PowerShell Exchange Online
windows

Uses the Exchange Online PowerShell module to send a batch of test emails from a legitimate account in rapid succession, simulating an adversary who has stolen credentials and is using them to distribute phishing lures to internal targets. This triggers the high-volume send detection signal. Run only in a test tenant or with explicit authorization.

Command

powershell 
# Requires ExchangeOnlineManagement module and test credentials
Install-Module ExchangeOnlineManagement -Force -ErrorAction SilentlyContinue;
Import-Module ExchangeOnlineManagement;
Connect-ExchangeOnline -UserPrincipalName '[email protected]' -ShowProgress $false;
$recipients = @('[email protected]','[email protected]','[email protected]');
foreach ($r in $recipients) {
  Send-MailMessage -SmtpServer smtp.office365.com -Port 587 `
    -From '[email protected]' -To $r `
    -Subject 'T1534 Test - Please Disregard' `
    -Body 'Authorized detection validation test only. Ref: T1534 Internal Spearphishing.' `
    -UseSSL -Credential (Get-Credential)
};
Disconnect-ExchangeOnline -Confirm:$false

Cleanup

powershell 
Recipients should delete the test messages. No persistent system changes.

Expected Telemetry

O365 Unified Audit Log: multiple Send operations from [email protected] within a short window. Exchange message trace: batch of outbound messages with identical subject. Azure AD: interactive authentication event for the PowerShell connection. OfficeActivity table in Sentinel: Operation=Send entries for each recipient.

Expected Detection

KQL Signal 2 (HighVolumeSend) fires if >20 messages sent within an hour bucket; adjust threshold down for test environments. SPL o365 subsearch fires with EmailsSent count exceeding threshold. Correlation with a risky sign-in (if simulated from an unusual IP) elevates confidence.

Related Detections

Tactic Hub

TA0008Lateral Movement

Related Techniques

T1566.001Spearphishing AttachmentT1566.002Spearphishing LinkT1078Valid AccountsT1656ImpersonationT1056.001KeyloggingT1114.001Local Email CollectionT1137.001Office Template MacrosT1204.002Malicious FileT1080Taint Shared ContentT1598.003Spearphishing Link

Same Tactic: Lateral Movement

Popular Detections