Microsoft Teams Forensics & Collaboration Triage

DFIR Investigation Charter

The Modern Collaboration Battleground: Microsoft Teams is rarely an isolated application; it is a presentation tier built on top of the Microsoft 365 Substrate. Chat messages, meeting transcripts, channel conversations, and shared files do not reside in a monolithic Teams database. Instead, they are distributed across Exchange Online mailboxes, SharePoint site collections, and OneDrive personal drives. This reference card demystifies where Teams data actually lives, how to track external federation threats, and how to execute defensible forensic extraction.

1. The Microsoft Teams Substrate Storage Disparity

To investigate Teams incidents, forensic practitioners must master the underlying storage architecture that maps Teams communication artifacts to backing workloads:

graph TD
    subgraph TeamsClient ["Microsoft Teams Presentation Tier (Client Apps & Web)"]
        Chat11["1:1 & Group Private Chats"]
        ChanMsg["Standard & Shared Channel Messages"]
        ChanFiles["Channel File Attachments"]
        ChatFiles["1:1 Chat File Attachments"]
        Recordings["Meeting Audio/Video Recordings"]
        Voice["Voicemails & Call Transcripts"]
    end

    subgraph BackingWorkloads ["Azure Substrate Storage Subsystems"]
        UserMBX["User Mailbox (Exchange Online)<br/>Hidden Folder: /TeamsChat"]
        GroupMBX["Group Mailbox (Exchange Online)<br/>Hidden Folder: /Conversation History/Teams"]
        SPOSite["SharePoint Team Site<br/>Document Library: /Shared Documents/ChannelName/"]
        ODBDrive["Sender's OneDrive for Business<br/>Folder: /Documents/Microsoft Teams Chat Files/"]
        MediaSPO["SharePoint / OneDrive Root<br/>Folder: /Recordings/"]
    end

    Chat11 --> UserMBX
    ChanMsg --> GroupMBX
    ChanFiles --> SPOSite
    ChatFiles --> ODBDrive
    Recordings --> MediaSPO
    Voice --> UserMBX

Comprehensive Storage Mapping Matrix

Communication Artifact	Primary Underlying Storage	Secondary Compliance Ingestion	Retention & Discovery Engine
1:1 & Group Chats	Azure Chat Service (Middle Tier)	Ingested into each participant’s Exchange Mailbox (TeamsChat)	Purview eDiscovery (Exchange Location)
Channel Messages	Azure Chat Service (Middle Tier)	Ingested into the M365 Group Mailbox (Conversation History/Teams)	Purview eDiscovery (Exchange Location)
Private Channel Chats	Azure Chat Service (Middle Tier)	Ingested into the personal mailboxes of private channel members	Purview eDiscovery (Exchange Location)
Channel Files	SharePoint Team Site Collection	Stored in document library: Shared Documents/<ChannelName>	SharePoint Forensics (FileAccessed, FileDownloaded)
1:1 Chat Files	Sender’s OneDrive for Business	Stored under Documents/Microsoft Teams Chat Files with auto-shared ACLs	OneDrive Forensics (FileDownloaded, SharingSet)
Meeting Recordings	SharePoint (Channel) or OneDrive (1:1)	Media blob saved under Recordings/	Purview UAL (FileDownloaded)

---

2. Teams Attack Vectors & External Federation Risks

Adversaries exploit Microsoft Teams to achieve initial access, execute social engineering, and exfiltrate sensitive files.

flowchart TD
    AttackVector[Teams Threat Vectors] --> ExtFed[1. External Federation & Guest Access]
    AttackVector --> PhishLure[2. Weaponized File Sharing]
    AttackVector --> AppSvc[3. Malicious Teams Bots / Webhooks]

    ExtFed --> ExtChat[Attacker initiates 1:1 chat from external tenant]
    ExtChat --> Evasion[Bypasses email security gateway / SEG filters]

    PhishLure --> CloudStorage[Attacker shares OneDrive link to malware in chat]
    CloudStorage --> AutoPermission[Teams auto-provisions access permissions to victim]

    AppSvc --> WebhookExfil[Incoming Webhook deployed to exfiltrate channel messages]

1. External Federation Exploitation (Cross-Tenant Social Engineering)

If the tenant’s external access policies allow communication with external domains, an attacker in an unvetted Microsoft 365 tenant can initiate direct 1:1 chats with internal employees.

• Bypass Advantage: Communication completely circumvents Secure Email Gateways (SEGs), Cisco SEG, Proofpoint, and standard email DMARC/SPF defenses.
• Visual Deception: Threat actors configure their external tenant display name to match “IT Support”, “Helpdesk Security”, or “Payroll Department”.

2. Weaponized Teams File Delivery

When a user uploads a file into a 1:1 Teams chat, Teams automatically stores the file in the sender’s OneDrive and grants view permissions to all chat participants. Threat actors use this automated sharing pipeline to drop malicious payloads (.vhd, .iso, or password-protected archives) that appear natively hosted on trusted corporate SharePoint infrastructure.

3. Malicious Incoming Webhooks & Rogue Apps

Adversaries who compromise a Teams team create Incoming Webhooks to continuously exfiltrate sensitive chat threads to external C2 listeners without requiring interactive sign-ins.

---

3. Purview UAL Auditing for Teams

Teams audit events are captured in the Purview Unified Audit Log under the MicrosoftTeams workload.

Key Teams Audit Operations

Operation	Action Logged	Critical Fields	Forensic Utility
MemberAdded	User or external guest added to a team	Members, TeamName, TeamGuid	Identifies unauthorized guest insertion
TeamCreated	New team provisioned	TeamName, Owner, Privacy	Tracks shadow IT and adversary command teams
ChannelAdded	Standard or private channel created	ChannelName, ChannelType	Detects staging channels created by attackers
AppInstalled	Third-party bot or integration installed	AppId, AddOnName	Uncovers malicious data-scraping applications
MessageSent	Message compliance audit (E5 required)	MessageId, Sender, Recipient	Reconstructs chat communications via eDiscovery
TabAdded	New tab or external website embedded in channel	TabName, TabUrl	Detects credential harvesting sites embedded in Teams

---

4. Detection Engineering: Teams Hunting Queries

KQL: External Guest Account Additions

// Detect external guests added to sensitive teams
CloudAppEvents
| where TimeGenerated >= ago(14d)
| where ActionType == "MemberAdded"
| extend Workload = tostring(RawEventData.Workload)
| where Workload =~ "MicrosoftTeams"
| extend TeamName = tostring(RawEventData.TeamName)
| extend MemberList = RawEventData.Members
| mv-expand MemberList
| extend MemberUPN = tostring(MemberList.UPN)
| where MemberUPN contains "#EXT#" or MemberUPN !endswith "@contoso.com"
| project TimeGenerated, AccountDisplayName, TeamName, MemberUPN, IPAddress, RawEventData
| sort by TimeGenerated desc

KQL: Incoming Webhook & App Installation

// Detect installation of incoming webhooks or suspicious third-party bots
CloudAppEvents
| where TimeGenerated >= ago(14d)
| where ActionType in ("AppInstalled", "AppUpgraded", "TabAdded")
| extend Workload = tostring(RawEventData.Workload)
| where Workload =~ "MicrosoftTeams"
| extend AppName = tostring(RawEventData.AddOnName)
| extend TeamName = tostring(RawEventData.TeamName)
| project TimeGenerated, AccountDisplayName, ActionType, AppName, TeamName, IPAddress
| sort by TimeGenerated desc

PowerShell: Extract Team Channel Configuration

<#
.SYNOPSIS
    Enumerates all channels, guests, and tabs for a compromised Microsoft Teams team.
#>
Connect-MicrosoftTeams

$TeamId = "11111111-2222-3333-4444-555555555555"

Write-Host "[+] Auditing Members for Team $TeamId..." -ForegroundColor Cyan
Get-TeamUser -GroupId $TeamId | Select-Object User, Role, Name

Write-Host "[+] Auditing Channels..." -ForegroundColor Cyan
Get-TeamChannel -GroupId $TeamId | Select-Object DisplayName, MembershipType

Write-Host "[+] Auditing Installed Apps & Connectors..." -ForegroundColor Cyan
Get-TeamsAppInstallation -TeamId $TeamId | Select-Object DisplayName, Id

---

5. Forensic Extraction via Purview eDiscovery

Because chat messages are synchronized into the Azure Substrate, investigators extract complete chat transcripts using Purview Content Search:

1. Target Exchange Mailboxes of Chat Participants: To extract 1:1 chats, target the individual Exchange Online mailboxes of all suspected participants:

   Connect-IPPSSession
   New-ComplianceSearch -Name "IR_TeamsChat_Investigation" `
       -ExchangeLocation "victim@contoso.com", "suspect@contoso.com" `
       -ContentMatchQuery '(kind:im) AND (Received >= "2026-09-01" AND Received <= "2026-09-17")'
   Start-ComplianceSearch -Name "IR_TeamsChat_Investigation"

2. Target Group Mailboxes for Channel Chats: To extract standard channel messages, target the backing Office 365 Group mailbox:

   New-ComplianceSearch -Name "IR_TeamsChannel_Investigation" `
       -ExchangeLocation "FinanceTeam@contoso.com" `
       -ContentMatchQuery '(kind:im)'
   Start-ComplianceSearch -Name "IR_TeamsChannel_Investigation"

3. Export and Reconstruct Threads: Export search results as .pst or individual .eml files. Review the hidden TeamsChat folder using forensic email parsers to inspect message timestamps, reactions, and embedded file sharing cards.

---

6. Related Intelligence & Cross-References

32. Microsoft 365 Data Attack Surface Mapping Understand multi-workload exposure vectors and the evidentiary threshold ladder.

34. SharePoint Online Forensics Investigate channel file storage residing in backing SharePoint Team sites.

35. OneDrive Forensics & Sync Exfiltration Analyze 1:1 chat attachments stored in the sender's OneDrive drive.

37. Data Access Paths & Blast Radius Synthesize Teams chat and file telemetry into a comprehensive regulatory blast radius.