File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)

id: e4f87c4a-0a56-4514-acfa-d662450132fa
name: File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)
description: |
  This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by the built-in SharePoint Online antivirus, using the FileMaliciousContentInfo table.
description-detailed: |
  The built-in SharePoint Online antivirus scans files uploaded to SharePoint, OneDrive and Teams. This query lists the malware families from those antivirus detections. It uses the DetectionMethods field in FileMaliciousContentInfo to separate the built-in antivirus from Microsoft Defender for Office 365 detonation, which is more precise than inferring the source from CloudAppEvents.
  This query is part of the Microsoft Defender for Office 365 Detections and Insights workbook in Microsoft Sentinel: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-3-build-custom-email-security-reports-with-power-bi-and-workbooks-in-micros/4490127
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - FileMaliciousContentInfo
tactics:
  - InitialAccess
  - LateralMovement
relevantTechniques:
  - T1566
  - T1080
query: |
  // DetectionMethods "Antimalware engine" indicates the built-in SharePoint Online antivirus.
  FileMaliciousContentInfo
  | where Timestamp > ago(30d)
  | where isnotempty(ThreatTypes)
  | where tostring(DetectionMethods) has "Antimalware engine"
  | summarize Files = count() by ThreatName = ThreatNames
  | top 50 by Files desc
version: 1.0.0