File Malware Detections Over Time (SharePoint, OneDrive and Teams)

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing (T1566) to deliver malicious files that are subsequently executed or analyzed via cloud-based security controls (T1080) within Microsoft 365 services. Proactively hunting for sustained or anomalous spikes in malware detections across SharePoint, OneDrive, and Teams allows the SOC to identify persistent footholds or lateral movement attempts that may have been missed by real-time alerts, ensuring rapid containment before the threat propagates further through the organization’s collaborative platforms.

KQL Query

let TimeStart = startofday(ago(30d));
let TimeEnd = startofday(now());
FileMaliciousContentInfo
| where Timestamp >= TimeStart
| where isnotempty(ThreatTypes)
| make-series FileMalwareDetections = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
| render timechart

Analytic Rule Definition

id: 1e361131-c7eb-4f7a-982f-a23d5d6a3490
name: File Malware Detections Over Time (SharePoint, OneDrive and Teams)
description: |
  This query shows the daily volume of file malware detections in SharePoint, OneDrive and Teams over the last 30 days, using the FileMaliciousContentInfo table.
description-detailed: |
  Microsoft Defender for Office 365 and the built-in SharePoint Online antivirus scan files uploaded to SharePoint, OneDrive and Teams. This query charts the daily count of files detected as malicious, so spikes and trends in collaboration-platform malware can be spotted and investigated.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
  - LateralMovement
relevantTechniques:
  - T1566
  - T1080
query: |
  let TimeStart = startofday(ago(30d));
  let TimeEnd = startofday(now());
  FileMaliciousContentInfo
  | where Timestamp >= TimeStart
  | where isnotempty(ThreatTypes)
  | make-series FileMalwareDetections = count() default = 0 on Timestamp from TimeStart to TimeEnd step 1d
  | render timechart
version: 1.0.0

MITRE ATT&CK Context

• Tactic: InitialAccess
• Tactic: LateralMovement
• Technique: T1566 — T1566
• Technique: T1080 — T1080

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/File Malware Detections Over Time.yaml)

False Positive Guidance

• Scenario: IT administrators or security teams upload known benign test files (e.g., EICAR_test.exe or specific EDR test payloads) to SharePoint or OneDrive to validate that the Microsoft Defender for Cloud Apps (MDCA) or native scanning policies are functioning correctly.

  • Filter/Exclusion: Exclude detections where the FileName matches known test patterns (e.g., *EICAR*, *test_malware*, *canary*) or where the UserPrincipalName belongs to a specific “SecurityOps” or “ITAdmin” security group.

• Scenario: Legacy or shared business applications (e.g., a shared Excel macro-enabled workbook used for financial reporting or a legacy PDF with embedded scripts) are stored in SharePoint/OneDrive and are repeatedly scanned by scheduled background jobs or triggered by user access, causing recurring detections for the same file hash.

  • Filter/Exclusion: Exclude detections where the FileHash is already present in a “Whitelisted Hashes” list maintained by the SOC, or exclude files with specific extensions (.xlsm, .pdf) if they are located in designated “Approved Documents” SharePoint sites or OneDrive folders.

• Scenario: Microsoft 365 Copilot or AI-powered features (such as Copilot in Teams or SharePoint) temporarily download or process user files into a temporary storage area that is indexed by the malware scanner before being cleaned up, resulting in transient false positives for files that are not actually persisted in the user’s primary drive.

  • Filter/Exclusion: Exclude detections where the FilePath contains temporary directory indicators (e.g., /temp/, /tmp/, or specific Copilot cache paths) or where the Duration of the detection is very short (e.g., < 5 minutes), indicating a transient scan rather than a persistent file.