BEC - File sharing tactics - OneDrive or SharePoint

id: cf8d2c27-8310-4b13-b135-1ba59ae0a3a2
name: BEC - File sharing tactics - OneDrive or SharePoint
description: |
  This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint
description-detailed: |
  This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint. 
  It highlights that a specific file has been shared by a user with multiple participants. Correlating this activity with suspicious sign-in attempts preceding this can help identify lateral movements and BEC attacks.
  Shared by Microsoft Threat Intelligence: https://www.microsoft.com/en-us/security/blog/2024/10/08/file-hosting-services-misused-for-identity-phishing/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - LateralMovement
relevantTechniques:
  - T1021
query: |
  let securelinkCreated = CloudAppEvents
  | where ActionType == "SecureLinkCreated"
  | project FileCreatedTime = Timestamp, AccountObjectId, ObjectName;
  let filesCreated = securelinkCreated
  | where isnotempty(ObjectName)
  | distinct tostring(ObjectName);
  CloudAppEvents
  | where ActionType == "AddedToSecureLink"
  | where Application in ("Microsoft SharePoint Online", "Microsoft OneDrive for Business")
  | extend FileShared = tostring(RawEventData.ObjectId)
  | where FileShared in (filesCreated)
  | extend UserSharedWith = tostring(RawEventData.TargetUserOrGroupName)
  | extend TypeofUserSharedWith = RawEventData.TargetUserOrGroupType
  | where TypeofUserSharedWith == "Guest"
  | where isnotempty(FileShared) and isnotempty(UserSharedWith)
  | join kind=inner securelinkCreated on $left.FileShared==$right.ObjectName
  // Secure file created recently (in the last 1day)
  | where (Timestamp - FileCreatedTime) between (1d .. 0h)
  | summarize NumofUsersSharedWith = dcount(UserSharedWith) by FileShared
  | where NumofUsersSharedWith >= 20
version: 1.0.0