Detection rules › By event

M365-SharePointFileOperation

Event	Rules
any	1
FileAccessed	4
FileDownloaded	10
FileMalwareDetected	3
FileSyncDownloadedFull	2
FileSyncUploadedFull	2
FileUploaded	7
SearchQueryPerformed	3

any

1 detection rules reference this event. View event page.

Splunk (1)

O365 Exfiltration via File Sync Download severity low T1530, T1567

FileAccessed

4 detection rules reference this event. View event page.

Elastic (1)

M365 SharePoint/OneDrive File Access via PowerShell severity high T1059, T1059.001, T1213, T1213.002, T1530

Splunk (1)

O365 Exfiltration via File Access severity low T1530, T1567

Kusto (1)

Accessed files shared by temporary external user severity low T1566

YARA-L (1)

O365 OneDrive Anonymous File Accessed severity medium T1048, T1048.002

FileDownloaded

10 detection rules reference this event. View event page.

Elastic (2)

M365 OneDrive/SharePoint Excessive File Downloads severity medium T1020, T1530, T1567
M365 SharePoint/OneDrive File Access via PowerShell severity high T1059, T1059.001, T1213, T1213.002, T1530

Splunk (1)

O365 Exfiltration via File Download severity low T1530, T1567

Kusto (5)

Dataverse - Mass download from SharePoint document management severity low T1567
Office365 Sharepoint File transfer above threshold severity medium T1020
Office365 Sharepoint File transfer Folders above threshold severity medium T1020
SharePointFileOperation via devices with previously unseen user agents severity medium T1030
SharePointFileOperation via previously unseen IPs severity medium T1030

YARA-L (2)

Hunt for Non-Anonymous Office 365 file downloads severity low T1048, T1048.002
O365 OneDrive Anonymous File Downloaded severity medium T1048, T1048.002

FileMalwareDetected

3 detection rules reference this event. View event page.

Elastic (2)

M365 OneDrive Malware File Upload severity high T1080, T1608, T1608.001
M365 SharePoint Malware File Detected severity high T1080, T1608, T1608.001

Splunk (1)

O365 SharePoint Malware Detection severity medium T1204, T1204.002

FileSyncDownloadedFull

2 detection rules reference this event. View event page.

Kusto (2)

Office365 Sharepoint File transfer above threshold severity medium T1020
Office365 Sharepoint File transfer Folders above threshold severity medium T1020

FileSyncUploadedFull

2 detection rules reference this event. View event page.

Kusto (2)

Office365 Sharepoint File transfer above threshold severity medium T1020
Office365 Sharepoint File transfer Folders above threshold severity medium T1020

FileUploaded

7 detection rules reference this event. View event page.

Kusto (7)

Accessed files shared by temporary external user severity low T1566
Dataverse - Executable uploaded to SharePoint document management site severity low T0863, T0873
New executable via Office FileUploaded Operation severity low T1105, T1570
Office365 Sharepoint File transfer above threshold severity medium T1020
Office365 Sharepoint File transfer Folders above threshold severity medium T1020
SharePointFileOperation via devices with previously unseen user agents severity medium T1030
SharePointFileOperation via previously unseen IPs severity medium T1030

SearchQueryPerformed

3 detection rules reference this event. View event page.

Elastic (1)

M365 SharePoint Search for Sensitive Content severity low T1213, T1213.002, T1530, T1619

Splunk (2)

O365 Email Suspicious Search Behavior severity low T1114, T1114.002, T1552
O365 SharePoint Suspicious Search Behavior severity low T1213, T1213.002, T1552