Microsoft‑Analyzer‑Suite adds Teams queries

Martin Willing’s Microsoft-Analyzer-Suite added a new Microsoft Teams investigation layer in version 1.9.0, released on July 6. The update extends UALGraph-Analyzer with 15 DuckDB queries for Teams data and highlights a built-in query called “TeamsImpersonationDetected,” according to the project’s GitHub release notes. (github.com) The suite is an open-source collection of PowerShell scripts for analyzing Microsoft 365 and Microsoft Entra ID data extracted by Microsoft-Extractor-Suite from Invictus Incident Response. The release is notable because it adds Teams-specific hunting to a toolkit already used to process Unified Audit Log, Entra sign-in, Entra audit, mailbox, risky-user and OAuth-permission data. (github.com) In the same July 6 release, Willing also added new OAuthPermissions-Analyzer inputs, including app registrations, service principals and Microsoft Entra Connect Sync artifacts. ### What exactly changed in v1.9.0? Version 1.9.0 added “Microsoft Teams Support (15 DuckDB Queries)” to UALGraph-Analyzer, the project’s graph-oriented analyzer for Unified Audit Log data. The release notes also called out “TeamsImpersonationDetected” and new statistics views for “ParticipatingDomains / ParticipatingTenantIds.” (github.com) The repository shows those Teams queries live under a dedicated `Queries/MicrosoftTeams` path. One indexed example, `MessageCreatedHasLink.sql`, extracts fields including `ParticipatingTenantIds` and `ParticipatingDomains` from audit data, alongside user, operation and timestamp fields. (github.com) ### Why do Teams impersonation queries matter to responders? Microsoft-Analyzer-Suite is built to analyze Microsoft 365 and Microsoft Entra ID artifacts, and its UAL tooling is aimed at Unified Audit Log review for digital forensics and incident response. In that context, Teams impersonation queries give responders a faster way to isolate suspicious messaging activity inside the same toolkit they already use for identity, mailbox and tenant-wide audit evidence. (github.com) The July 6 release notes did not describe detection logic in prose, but the named outputs point to evidence that investigators often need in control-plane cases: who sent a message, when it was created, and which external domains or tenant IDs were involved. (github.com) The surfaced `ParticipatingDomains` and `ParticipatingTenantIds` fields are the clearest sign that the new Teams coverage is designed to help trace cross-tenant interactions and possible spoofing patterns in audit data. That is an inference from the query names and exposed fields. ### How does this fit into the broader suite? The GitHub README describes Microsoft-Analyzer-Suite as automated processing for Microsoft 365 logs and Microsoft Entra ID logs. (github.com) The supported inputs already span admin users, devices, Entra audit logs, Entra sign-in logs, mailbox permissions, message trace, MFA, risky detections, risky users, transport rules and OAuth permissions. UALGraph-Analyzer itself first appeared in version 1.8.0 on June 1 with DuckDB as its database backend for “fast analytical queries,” according to the release history. Version 1.9.0 is the first release note that explicitly adds Microsoft Teams support to that component. (github.com) ### Where can investigators get the new queries? The LETHAL-FORENSICS GitHub repository hosts the code, release assets and wiki for Microsoft-Analyzer-Suite. The current release page lists v1.9.0 as the latest version, and the repository’s Teams query files are published under the MicrosoftTeams query directory. The project’s wiki says the suite analyzes data extracted via Microsoft-Extractor-Suite by Invictus Incident Response, which means responders using that collection workflow can review the new Teams queries alongside existing Entra, mailbox and OAuth analyzers. (github.com) The next documented milestone in the release notes is “UALGraph-Analyzer v0.2,” which Willing said is already in the works, along with a “SignInLogsGraph-Analyzer.” (github.com 1) (github.com 2) (github.com 3)