File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)

Hunt Hypothesis

This hypothesis targets adversaries leveraging phishing campaigns (T1566) to deliver known malware families via Microsoft 365 collaboration platforms, where files are detonated and identified by Defender for Office 365. Proactive hunting is critical to identify persistent or recurring malware families in SharePoint, OneDrive, and Teams, enabling the SOC to isolate affected users and block specific file hashes before lateral movement occurs.

KQL Query

// DetectionMethods "detonation" indicates a Microsoft Defender for Office 365 Safe Attachments detonation verdict.
FileMaliciousContentInfo
| where Timestamp > ago(30d)
| where isnotempty(ThreatTypes)
| where tostring(DetectionMethods) has "detonation"
| summarize Files = count() by ThreatName = ThreatNames
| top 50 by Files desc

Analytic Rule Definition

id: c2c416d7-e7ac-4e1d-ad74-10d939cf0be5
name: File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)
description: |
  This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by Microsoft Defender for Office 365 (Safe Attachments detonation), using the FileMaliciousContentInfo table.
description-detailed: |
  Microsoft Defender for Office 365 detonates files uploaded to SharePoint, OneDrive and Teams. This query lists the malware families from those detonation verdicts. It uses the DetectionMethods field in FileMaliciousContentInfo to separate Defender for Office 365 detonation detections from the built-in SharePoint antivirus, which is more precise than inferring the source from CloudAppEvents.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
  - LateralMovement
relevantTechniques:
  - T1566
  - T1080
query: |
  // DetectionMethods "detonation" indicates a Microsoft Defender for Office 365 Safe Attachments detonation verdict.
  FileMaliciousContentInfo
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatTypes)
  | where tostring(DetectionMethods) has "detonation"
  | summarize Files = count() by ThreatName = ThreatNames
  | top 50 by Files desc
version: 1.0.0

MITRE ATT&CK Context

Tactic: InitialAccess
Tactic: LateralMovement
Technique: T1566 — T1566
Technique: T1080 — T1080

References

[Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/File Malware Top Families by MDO Detonation.yaml)

False Positive Guidance

Scenario: A security team or incident response (IR) squad uploads a known benign test file (e.g., EICAR_test.docx or a specific malware sample for validation) to a SharePoint “Detection Validation” site or OneDrive folder to verify that Safe Attachments is correctly detonating and flagging files.
- Filter/Exclusion: Exclude files where the FileName matches known test patterns (e.g., *EICAR*, *test*, *validation*) or exclude detections originating from specific SharePoint site collections or OneDrive folders designated for security testing (e.g., SiteCollectionName contains SecurityTest or IRValidation).
Scenario: A legacy application or third-party integration (e.g., a specific ERP system or document management tool) generates or uploads temporary files with extensions that Defender’s detonation engine occasionally misclassifies as “Generic” or “Heuristic” malware families due to unusual binary structures or packed code, particularly in Teams channel files.
- Filter/Exclusion: Exclude detections where the FileExtension is in a list of known benign temporary extensions (e.g., .tmp, .bak, .swp) and the MaliciousFamily is a generic or heuristic name (e.g., Generic, Heuristic, Packed) rather than a specific named family (e.g., Emotet, Trickbot). Additionally, exclude files uploaded by specific service accounts (e.g., AccountName ends with -svc or -integration).
Scenario: An IT administrator performs a bulk migration or backup restore operation, uploading large archives or compressed files (e.g., .zip, .rar) to OneDrive or SharePoint. If the archive contains nested files with known benign signatures that Defender’s detonation engine flags as part of a “top family” due to high volume or specific heuristic