File Malware Detections by Location (SharePoint, OneDrive and Teams)

Hunt Hypothesis

Adversaries often distribute malicious payloads via phishing attachments or compromised links that land in collaborative platforms like SharePoint, OneDrive, and Teams, leveraging these trusted locations to bypass initial perimeter defenses. Proactively hunting for these detections allows the SOC to identify compromised user files and assess lateral movement risks before the malware executes or propagates further across the organization.

KQL Query

// FileMaliciousContentInfo records malicious-content findings for files in SharePoint, OneDrive and Teams.
FileMaliciousContentInfo
| where Timestamp > ago(30d)
| where isnotempty(ThreatTypes)
// FolderPath segment [4] is the SharePoint site or the OneDrive personal location where the file resides.
| extend Location = tostring(split(FolderPath, '/')[4])
| summarize FileMalwareDetections = count(), DistinctFiles = dcount(SHA256) by Location
| top 100 by FileMalwareDetections desc

Analytic Rule Definition

id: 3a9fa02a-4510-47a2-b76f-3be67c9ae06f
name: File Malware Detections by Location (SharePoint, OneDrive and Teams)
description: |
  This query surfaces malware detections in files stored in SharePoint, OneDrive and Teams, grouped by the site or personal location where each file resides, using the FileMaliciousContentInfo table.
description-detailed: |
  Microsoft Defender for Office 365 and the built-in SharePoint Online antivirus scan files uploaded to SharePoint, OneDrive and Teams. This query groups the resulting malware detections by the SharePoint site or OneDrive personal location (parsed from FolderPath), so the most affected locations can be prioritised for remediation.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
  - LateralMovement
relevantTechniques:
  - T1566
  - T1080
query: |
  // FileMaliciousContentInfo records malicious-content findings for files in SharePoint, OneDrive and Teams.
  FileMaliciousContentInfo
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatTypes)
  // FolderPath segment [4] is the SharePoint site or the OneDrive personal location where the file resides.
  | extend Location = tostring(split(FolderPath, '/')[4])
  | summarize FileMalwareDetections = count(), DistinctFiles = dcount(SHA256) by Location
  | top 100 by FileMalwareDetections desc
version: 1.0.0

MITRE ATT&CK Context

• Tactic: InitialAccess
• Tactic: LateralMovement
• Technique: T1566 — T1566
• Technique: T1080 — T1080

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/File Malware Detections by Location.yaml)

False Positive Guidance

• Scenario: An IT administrator or security team intentionally uploads a known benign test file (e.g., EICAR_test_file.txt or a specific vulnerability exploit sample) to a SharePoint “Security Testing” site or OneDrive personal folder to validate that the cloud antivirus engine is functioning correctly.

  • Filter/Exclusion: Exclude files where the FileName matches common test patterns (e.g., *EICAR*, *test*, *sample*) or restrict the query to exclude specific SharePoint site collections designated for testing (e.g., SiteName containing “QA” or “Security-Lab”).

• Scenario: A developer or data analyst uses a tool like Git LFS or a custom Python script to upload large binary assets (such as .dll files, .exe installers, or compressed archives) to OneDrive for Business for version control or sharing with a team, and the cloud AV engine flags a legitimate but complex binary as suspicious due to heuristic scoring.

  • Filter/Exclusion: Exclude detections where the FileExtension is in a whitelist of common development artifacts (e.g., .dll, .so, .jar, .whl) if the DetectionType is “Heuristic” rather than “Signature”, or exclude files located in specific OneDrive folders named “Dev”, “Builds”, or “Artifacts”.

• Scenario: A marketing or product team shares a legacy application installer (e.g., an old .msi or .exe for a niche industry tool) via a Microsoft Teams channel, and the file is flagged because it is an unsigned binary or has an outdated timestamp, triggering a false positive in the FileMaliciousContentInfo table.

  • Filter/Exclusion: Exclude detections where the FileHash (SHA256) matches a pre-approved list of known-good hashes