Microsoft365 External Document Sharing

Description

Document shared externally

Query · python

import re
from fnmatch import fnmatch

from panther_base_helpers import EMAIL_REGEX
from panther_msft_helpers import m365_alert_context

ALLOWED_DOMAINS = ["mycompany.com", "alloweddomain.com"]  # should be in lowercase

ALLOWED_USERS = ["exception@outsider.com"]  # should be in lowercase

ALLOWED_PATHS = ["*/External/*", "External/*"]


def allowed_path(relative_url):
    for path in ALLOWED_PATHS:
        if fnmatch(relative_url, path):
            return True
    return False


def rule(event):
    if event.get("Operation", "") == "AnonymousLinkCreated":
        return not allowed_path(event.get("SourceRelativeUrl"))
    if event.get("Operation", "") == "AddedToSecureLink":
        if allowed_path(event.get("SourceRelativeUrl")):
            return False
        target = event.get("TargetUserOrGroupName", "")
        if target.lower() in ALLOWED_USERS:
            return False
        if re.fullmatch(EMAIL_REGEX, target):
            if target.split("@")[1].lower() not in ALLOWED_DOMAINS:
                return True
    return False


def title(event):
    return (
        f"Microsoft365: [{event.get('SourceRelativeUrl')}] "
        "has been shared with external users by "
        f"[{event.get('UserId', '<user-not-found>')}]"
    )


def alert_context(event):
    return m365_alert_context(event)

Analyst notes

Check the document metadata to ensure it is not a sensitive document.

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.