O365 SharePoint Malware Detection

name: O365 SharePoint Malware Detection
id: 583c5de3-7709-44cb-abfc-0e828d301b59
version: 12
creation_date: '2024-04-07'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies when a malicious file is detected within the SharePoint Online ecosystem. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Operation=FileMalwareDetected
      | rename UserId as user, Id as signature_id
      | stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime
        BY signature_id, user, dest,
           src, vendor_account, vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `o365_sharepoint_malware_detection_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: No false positives have been identified at this time.
references:
    - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide
finding:
    title: SharePoint detected a potentially malicious file $file_name$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: file_name
      type: file_name
analytic_story:
    - Azure Active Directory Persistence
    - Office 365 Account Takeover
    - Ransomware Cloud
asset_type: O365 Tenant
mitre_attack_id:
    - T1204.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat