O365 SharePoint Malware Detection

Try in Splunk Security Cloud

Description

The following analytic identifies when a malicious file is detected within the SharePoint Online ecosystem. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions.

• Type: TTP

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2024-04-01
• Author: Steven Dick
• ID: 583c5de3-7709-44cb-abfc-0e828d301b59

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1204.002	Malicious File	Execution

T1204

User Execution

Execution

Kill Chain Phase

• Installation

NIST

• DE.CM

CIS20

• CIS 10

CVE

Search

`o365_management_activity` Operation=FileMalwareDetected 
| stats values(Workload) as category, values(SourceFileName) as file_name values(ObjectId) as file_path, values(VirusInfo) as signature, count, min(_time) as firstTime, max(_time) as lastTime by Id, UserId 
| rename Id as signature_id, UserId as user 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_sharepoint_malware_detection_filter`

Macros

The SPL above uses the following Macros:

• o365_management_activity
• security_content_ctime

o365_sharepoint_malware_detection_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• _time
• Operation
• Workload
• SourceFileName
• ObjectId
• VirusInfo
• Id
• UserId

How To Implement

You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.

Known False Positives

unknown

Associated Analytic Story

• Azure Active Directory Persistence
• Office 365 Account Takeover
• Ransomware Cloud

RBA

Risk Score	Impact	Confidence	Message
75.0	75	100	SharePoint detected a potentially malicious file $file_name$

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about?view=o365-worldwide

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1