← Back to SOC feed Coverage →

File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)

kql MEDIUM Azure-Sentinel
T1566T1080
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-09-03T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hypothesis targets adversaries who leverage phishing (T1566) to deliver known malware families via file attachments in SharePoint, OneDrive, or Teams, subsequently using command and script interpreter execution (T1080) to establish a foothold. Proactively hunting for these detections allows the SOC to identify compromised user accounts and lateral movement vectors early, mitigating the risk of persistent threats hidden within collaborative file storage before they escalate to broader infrastructure impact.

KQL Query

// DetectionMethods "Antimalware engine" indicates the built-in SharePoint Online antivirus.
FileMaliciousContentInfo
| where Timestamp > ago(30d)
| where isnotempty(ThreatTypes)
| where tostring(DetectionMethods) has "Antimalware engine"
| summarize Files = count() by ThreatName = ThreatNames
| top 50 by Files desc

Analytic Rule Definition

id: e4f87c4a-0a56-4514-acfa-d662450132fa
name: File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)
description: |
  This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by the built-in SharePoint Online antivirus, using the FileMaliciousContentInfo table.
description-detailed: |
  The built-in SharePoint Online antivirus scans files uploaded to SharePoint, OneDrive and Teams. This query lists the malware families from those antivirus detections. It uses the DetectionMethods field in FileMaliciousContentInfo to separate the built-in antivirus from Microsoft Defender for Office 365 detonation, which is more precise than inferring the source from CloudAppEvents.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
  - LateralMovement
relevantTechniques:
  - T1566
  - T1080
query: |
  // DetectionMethods "Antimalware engine" indicates the built-in SharePoint Online antivirus.
  FileMaliciousContentInfo
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatTypes)
  | where tostring(DetectionMethods) has "Antimalware engine"
  | summarize Files = count() by ThreatName = ThreatNames
  | top 50 by Files desc
version: 1.0.0

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/File Malware Top Families by SharePoint Antivirus.yaml