Office365 Sharepoint File transfer Folders above threshold

Severity: medium
Time window: 15m
Group by: ClientIP, UserAgent, UserId
Source: github.com/Azure/Azure-Sentinel

Identifies Office365 Sharepoint File Transfers with distinct folder count above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1020` Automated Exfiltration

Telemetry coverage

Platform	Record / event type
Microsoft 365	FileDownloaded
Microsoft 365	FileSyncDownloadedFull
Microsoft 365	FileSyncUploadedFull
Microsoft 365	FileUploaded

Rules detecting the same action

These rules filter on the same operation.

Rule body

id: 8a547285-801c-4290-aa2e-5e7e20ca157d
name: Office365 Sharepoint File transfer Folders above threshold
description: |
  'Identifies Office365 Sharepoint File Transfers with distinct folder count above certain threshold in a 15min time period.
   Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.'
severity: Medium
requiredDataConnectors:
  - connectorId: Office365
    dataTypes:
      - OfficeActivity (SharePoint)
queryFrequency: 15m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1020
query: |
  let threshold = 500;
  OfficeActivity
  | where EventSource == "SharePoint" and OfficeWorkload has_any("SharePoint", "OneDrive") and Operation has_any ("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")
  | summarize count_distinct_SourceRelativeUrl=dcount(SourceRelativeUrl), dirlist=make_set(SourceRelativeUrl, 10000) by UserId,ClientIP,UserAgent,bin(TimeGenerated, 15m)
  | where count_distinct_SourceRelativeUrl >= threshold
  | extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField","_", tostring(hash(tostring(dirlist)))))
  | extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: UserId
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIP
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: DirSample
customDetails:
  TransferCount: count_distinct_SourceRelativeUrl
  FilesList: dirlist
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT5H
    matchingMethod: Selected
    groupByEntities:
    - Account
    groupByAlertDetails: []
    groupByCustomDetails: []
version: 1.0.6
kind: Scheduled

Stages and Predicates

Parameters

let threshold = 500;

Stage 1: `source`

OfficeActivity

Stage 2: `where`

| where EventSource == "SharePoint" and OfficeWorkload has_any("SharePoint", "OneDrive") and Operation has_any ("FileDownloaded", "FileSyncDownloadedFull", "FileSyncUploadedFull", "FileUploaded")

Stage 3: `summarize`

| summarize count_distinct_SourceRelativeUrl=dcount(SourceRelativeUrl), dirlist=make_set(SourceRelativeUrl, 10000) by UserId,ClientIP,UserAgent,bin(TimeGenerated, 15m)

Stage 4: `where`

| where count_distinct_SourceRelativeUrl >= threshold

Stage 5: `extend`

| extend DirSample = iff(array_length(dirlist) == 1, tostring(dirlist[0]), strcat("SeeDirListField","_", tostring(hash(tostring(dirlist)))))

DirSample =

ifdirlist == 1tostring(dirlist[0])

elsestrcat("SeeDirListField", "_", tostring(hash(tostring(dirlist))))

Stage 6: `extend`

| extend AccountName = tostring(split(UserId, "@")[0]), AccountUPNSuffix = tostring(split(UserId, "@")[1])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventSource`	eq	`SharePoint`	`field:"aws::eventSource" kind:eq value:"SharePoint"`
`OfficeWorkload`	match	`OneDrive` transforms: `term` `SharePoint` transforms: `term`	`field:"m365::Workload" kind:match`
`Operation`	match	`FileDownloaded` transforms: `term` `FileSyncDownloadedFull` transforms: `term` `FileSyncUploadedFull` transforms: `term` `FileUploaded` transforms: `term`	`field:"Operation" kind:match`
`count_distinct_SourceRelativeUrl`	ge	`500`	`field:"count_distinct_SourceRelativeUrl" kind:ge value:"500"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`ClientIP`	`summarize`
`UserAgent`	`summarize`
`UserId`	`summarize`
`count_distinct_SourceRelativeUrl`	`summarize`
`dirlist`	`summarize`
`DirSample`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`