File Malware Detections by Workload (SharePoint, OneDrive and Teams)

Hunt Hypothesis

This hypothesis targets adversaries who embed malicious payloads into files within Microsoft 365 collaboration workloads to establish a foothold or execute code, leveraging the high trust and connectivity of SharePoint, OneDrive, and Teams. Proactively hunting for these detections allows the SOC to identify compromised user assets and potential lateral movement vectors before the malware can be executed or spread further across the organization.

This hypothesis targets adversaries who embed malicious payloads into files within Microsoft 365 collaboration workloads to establish a foothold or execute code, leveraging the high trust and connectivity of SharePoint, OneDrive, and Teams. Proactively hunting for these detections allows the SOC to identify compromised user assets and potential lateral movement vectors before the malware can be executed or spread further across the organization.

KQL Query

// FileMaliciousContentInfo records malicious-content findings for files in SharePoint, OneDrive and Teams.
FileMaliciousContentInfo
| where Timestamp > ago(30d)
| where isnotempty(ThreatTypes)
| summarize FileMalwareDetections = count(), DistinctFiles = dcount(SHA256) by Workload
| sort by FileMalwareDetections desc

Analytic Rule Definition

id: a895b106-6436-4586-aba7-26aee8309e64
name: File Malware Detections by Workload (SharePoint, OneDrive and Teams)
description: |
  This query summarises malware detections in files stored in SharePoint, OneDrive and Teams by the Microsoft 365 collaboration workload, using the FileMaliciousContentInfo table.
description-detailed: |
  Microsoft Defender for Office 365 and the built-in SharePoint Online antivirus scan files across Microsoft 365 collaboration workloads. This query breaks the malware detections down by workload (SharePoint, OneDrive and Microsoft Teams) to show where malicious content is most concentrated.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
  - LateralMovement
relevantTechniques:
  - T1566
  - T1080
query: |
  // FileMaliciousContentInfo records malicious-content findings for files in SharePoint, OneDrive and Teams.
  FileMaliciousContentInfo
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatTypes)
  | summarize FileMalwareDetections = count(), DistinctFiles = dcount(SHA256) by Workload
  | sort by FileMalwareDetections desc
version: 1.0.0

MITRE ATT&CK Context

• Tactic: InitialAccess
• Tactic: LateralMovement
• Technique: T1566 — T1566
• Technique: T1080 — T1080

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/File Malware Detections by Workload.yaml)

False Positive Guidance

• Scenario: Legacy or Obsolete File Formats in SharePoint Libraries

  • Context: Users upload older versions of documents (e.g., .doc, .xls, or .ppt from Office 97-2003) to SharePoint sites for archival or reference. Microsoft’s static analysis engine may flag these legacy formats as “Generic.Malware” or “W97M” variants due to known vulnerabilities in the file structure, even if the file is clean.
  • Filter/Exclusion: Exclude detections where the FileExtension is in ['.doc', '.xls', '.ppt'] AND the DetectionType is Static (or specific legacy engine IDs). Alternatively, exclude files older than 365 days that have not been opened in the last 90 days.

• Scenario: Scheduled PowerShell Scripts in OneDrive for Business

  • Context: IT administrators or power users store PowerShell scripts (.ps1) in OneDrive for Business to manage local machine configurations or perform automated backups. These scripts often contain base64-encoded strings or complex command chains that heuristic engines misinterpret as obfuscated malware (e.g., Trojan.GenericKDD or W32/Agent).
  • Filter/Exclusion: Exclude detections where the FileName ends with .ps1 AND the UserPrincipalName belongs to the IT-Admins or ServiceAccounts security group. Additionally, exclude if the DetectionSource is Heuristic and the file size is less than 50KB.

• Scenario: Shared Excel Workbooks with External Links in Teams

  • Context: Finance or operations teams share large Excel workbooks (.xlsx) in Microsoft Teams channels that contain external hyperlinks or embedded objects. The FileMaliciousContentInfo table may flag these