File Scanning Coverage (SharePoint, OneDrive and Teams)

Hunt Hypothesis

This hypothesis targets the adversary behavior of delivering malicious payloads via common collaboration platforms (T1566) and the subsequent execution or persistence of those files (T1080), which often bypass traditional perimeter defenses. Proactively hunting for gaps in file scanning coverage within Azure Sentinel ensures that SOC teams can identify unscanned or undetected files in SharePoint, OneDrive, and Teams, thereby reducing the risk of overlooked malware that has already been ingested into the user environment.

KQL Query

FileMaliciousContentInfo
| where Timestamp > ago(30d)
| summarize FilesProcessed = count(),
            FilesWithMalware = countif(isnotempty(ThreatTypes)),
            FilesNoDetection = countif(isempty(ThreatTypes))
| extend DetectionRatePct = iif(FilesProcessed == 0, 0.0, round(100.0 * FilesWithMalware / FilesProcessed, 2))

Analytic Rule Definition

id: 7d86be89-dbdd-487e-961a-80228935563f
name: File Scanning Coverage (SharePoint, OneDrive and Teams)
description: |
  This query summarises file scanning coverage in SharePoint, OneDrive and Teams: how many files were processed, how many were found malicious, and how many were scanned with no detection, using the FileMaliciousContentInfo table.
description-detailed: |
  The FileMaliciousContentInfo table records files scanned across SharePoint, OneDrive and Teams, whether or not a threat was found. This query reports the total files processed, the number found malicious and the number scanned with no detection, with a detection rate. This scanning-coverage view is not available from action-only sources such as CloudAppEvents.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
  - LateralMovement
relevantTechniques:
  - T1566
  - T1080
query: |
  FileMaliciousContentInfo
  | where Timestamp > ago(30d)
  | summarize FilesProcessed = count(),
              FilesWithMalware = countif(isnotempty(ThreatTypes)),
              FilesNoDetection = countif(isempty(ThreatTypes))
  | extend DetectionRatePct = iif(FilesProcessed == 0, 0.0, round(100.0 * FilesWithMalware / FilesProcessed, 2))
version: 1.0.0

MITRE ATT&CK Context

• Tactic: InitialAccess
• Tactic: LateralMovement
• Technique: T1566 — T1566
• Technique: T1080 — T1080

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/File Scanning Coverage.yaml)

False Positive Guidance

• Bulk Migration or Import via SharePoint PowerShell

  • Scenario: An IT administrator performs a large-scale data migration from a legacy file server to SharePoint using the Move-SPFile or Add-SPFile cmdlets in PowerShell. This action triggers a high volume of file creation events that the scanning engine must process, potentially causing a spike in “files processed” metrics that looks like anomalous activity if not correlated with a change ticket.
  • Filter/Exclusion: Exclude events where the source IP is a known management server (e.g., 10.0.5.10) and the user account is a service account (e.g., svc-sharepoint-admin). Alternatively, correlate with a recent “Change Request” status in the ITSM tool within the last 24 hours.

• Scheduled Automated Backup or Sync Jobs

  • Scenario: A nightly scheduled task runs a third-party backup tool (e.g., Veeam, Commvault, or Microsoft 365 Backup) that syncs OneDrive or SharePoint libraries to an external storage tier. This generates consistent, high-volume file read/write operations that appear as a sudden increase in scanning coverage metrics during off-hours, which might be flagged as unusual activity if the baseline is calculated only during business hours.
  • Filter/Exclusion: Filter out events occurring between 02:00–04:00 UTC where the user principal is a known service principal (e.g., app-backup-sync) and the operation type is “Sync” or “Backup”. Ensure the exclusion list includes the specific App ID registered for the backup solution.

• Teams Channel Creation with Default Templates

  • Scenario: A department head creates a new Teams channel using a standard template (e.g., “Project Management” or “HR Onboarding”). This action automatically provisions multiple default files