detection.wiki

Detection rules › YARA-L

O365 OneDrive Anonymous Link Accessed

Severity
medium
Type
hunt
Time window
5m
Match by
ip
Author
Google Cloud Security
Source
github.com/chronicle/detection-rules

Anonymous links can be used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1048.002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Event coverage

ProviderEvent
M365-SharePointSharingOperationAnonymousLinkUsed

Rule body yaral

/*
 * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rule o365_onedrive_anonymous_link_accessed {

  meta:
    author = "Google Cloud Security"
    description = "Anonymous links can be used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive."
    rule_id = "mr_7e67005a-d5fc-4497-8e81-e6797b2f54e9"
    rule_name = "O365 OneDrive Anonymous Link Accessed"
    tactic = "TA0010"
    technique = "T1048.002"
    type = "hunt"
    platform = "azure"
    data_source = "o365"
    severity = "Medium"
    priority = "Medium"

  events:
    $file.metadata.event_type = "USER_RESOURCE_ACCESS"
    $file.metadata.product_event_type = "AnonymousLinkUsed"
    $file.metadata.product_name = "Office 365"
    $file.metadata.vendor_name = "Microsoft"
    $file.principal.user.userid = "anonymous"
    $file.principal.ip = $ip

  match:
    $ip over 5m

  outcome:
    $risk_score = 35
    $event_count = count_distinct($file.metadata.id)
    $referral_url = array_distinct($file.network.http.referral_url)
    $user_agent = array_distinct($file.network.http.user_agent)
    $principal_application = array_distinct($file.principal.application)
    $principal_ip = array_distinct($file.principal.ip)
    $target_application = array_distinct($file.target.application)
    $principal_user_userid = array_distinct($file.principal.user.userid)
    $target_file_full_path = array_distinct($file.target.file.full_path)
    $target_url = array_distinct($file.target.url)

  condition:
    $file
}

Detection logic

Fires when at least one $file event in the 5m window.

Events

$file USER_RESOURCE_ACCESS

  • metadata.product_event_type = "AnonymousLinkUsed"
  • principal.user.userid = "anonymous"

Correlation

Match key
$ip (principal.ip)
Within
5m

Outcome

Fields the detection emits on a match. $risk_score drives alerting; Chronicle surfaces the rest on the detection.

FieldExpression
risk_score35
event_countcount_distinct($file.metadata.id)
referral_urlarray_distinct($file.network.http.referral_url)
user_agentarray_distinct($file.network.http.user_agent)
principal_applicationarray_distinct($file.principal.application)
principal_iparray_distinct($file.principal.ip)
target_applicationarray_distinct($file.target.application)
principal_user_useridarray_distinct($file.principal.user.userid)
target_file_full_patharray_distinct($file.target.file.full_path)
target_urlarray_distinct($file.target.url)