Top File Owners Holding Malware (SharePoint, OneDrive and Teams)

Hunt Hypothesis

This hypothesis targets adversaries who leverage phishing or initial access vectors to deposit malicious files into collaborative platforms like SharePoint, OneDrive, and Teams, thereby establishing a foothold for lateral movement or persistence. Proactively hunting for these top file owners allows the SOC to identify high-impact infection sources and assess the blast radius of compromised assets before the malware propagates further through user interactions or automated workflows.

KQL Query

// Groups by the file owner, or by the SharePoint/Teams site when a file has no individual owner.
FileMaliciousContentInfo
| where Timestamp > ago(30d)
| where isnotempty(ThreatTypes)
| extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat('Site: ', tostring(split(FolderPath, '/')[4])))
| summarize MaliciousFiles = count(),
            DistinctFiles = dcount(SHA256),
            Workloads = make_set(Workload, 3),
            SampleThreats = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),
            LastSeen = max(Timestamp)
    by Owner
| top 20 by MaliciousFiles

Analytic Rule Definition

id: fe2faae3-9864-44b0-a42d-8e829baa34a9
name: Top File Owners Holding Malware (SharePoint, OneDrive and Teams)
description: |
  This query lists the file owners (or the SharePoint/Teams site, when a file has no individual owner) whose files in SharePoint, OneDrive or Teams were flagged as malware, using the FileMaliciousContentInfo table.
description-detailed: |
  Microsoft Defender for Office 365 and the built-in SharePoint Online antivirus scan files across SharePoint, OneDrive and Teams. This query ranks the owners (or sites) holding the most malicious files, with the count of malicious files, distinct files by hash, affected workloads and sample threat names, to pinpoint the accounts and locations most affected for targeted remediation.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
  - LateralMovement
relevantTechniques:
  - T1566
  - T1080
query: |
  // Groups by the file owner, or by the SharePoint/Teams site when a file has no individual owner.
  FileMaliciousContentInfo
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatTypes)
  | extend Owner = iff(isnotempty(FileOwnerUpn), FileOwnerUpn, strcat('Site: ', tostring(split(FolderPath, '/')[4])))
  | summarize MaliciousFiles = count(),
              DistinctFiles = dcount(SHA256),
              Workloads = make_set(Workload, 3),
              SampleThreats = make_set_if(ThreatNames, isnotempty(ThreatNames), 5),
              LastSeen = max(Timestamp)
      by Owner
  | top 20 by MaliciousFiles
version: 1.0.0

MITRE ATT&CK Context

• Tactic: InitialAccess
• Tactic: LateralMovement
• Technique: T1566 — T1566
• Technique: T1080 — T1080

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Email and Collaboration Queries/Malware/Top File Owners Holding Malware.yaml)

False Positive Guidance

• Security Team Sandbox Testing and Quarentine Validation

  • Scenario: Security analysts or EDR vendors (e.g., CrowdStrike, SentinelOne) frequently upload known malware samples (EICAR, specific EDR test files, or real-world malware captures) to SharePoint or OneDrive to validate that the cloud-based antivirus (Microsoft Defender for Cloud Apps) or third-party CASB is correctly detecting and isolating threats. These files are often intentionally left in a “test” folder or site for a short period.
  • Filter/Exclusion: Exclude file owners whose DisplayName or Email contains keywords like “Security”, “SOC”, “BlueTeam”, or “Sandbox”. Alternatively, exclude files where the FileName matches known test patterns (e.g., EICAR, Test_Malware, Sample_*.exe) or where the SiteName includes “Test”, “Sandbox”, or “Validation”.

• IT Admins Uploading Large ISOs or Disk Images for Distribution

  • Scenario: IT administrators or DevOps engineers upload large .iso, .vhd, or .img files (e.g., Windows 11 installation media, Linux distros, or custom Docker images) to SharePoint for internal distribution. Some heuristic-based malware scanners may flag these large, complex binary files as “Suspicious” or “Malicious” due to their size, entropy, or embedded executables, even though they are legitimate distribution artifacts.
  • Filter/Exclusion: Exclude file extensions commonly associated with disk images or archives (.iso, .vhd, .vhdx, .img, .wim, .cab, .msi). Additionally, consider excluding files where the FileSize exceeds a threshold (e.g., 500MB) and the FileExtension is in the list above, as these are rarely small malware