O365 Exfiltration via File Sync Download

name: O365 Exfiltration via File Sync Download
id: 350837b5-13d3-4c06-b688-db07afbe5050
version: 6
creation_date: '2025-01-28'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: Anomaly
description: The following analytic detects when an excessive number of files are sync from o365 by the same user over a short period of time. A malicious actor abuse the user-agent string through GUI or API access to evade triggering the FileDownloaded event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
data_source:
    - Office 365 Universal Audit Log
search: |-
    `o365_management_activity` Operation IN ("filesyncdownload*") UserAgent="*SkyDriveSync*"
    | eval user = replace(mvindex(split(lower(UserId),"#ext#"),0),"_","@"), user_flat = replace(UserId, "[^A-Za-z0-9]","_")
    | where NOT match(SiteUrl,user_flat)
    | stats values(user) as user, latest(ClientIP) as src values(ZipFileName) as file_name, values(Operation) as signature, values(UserAgent) as http_user_agent, dc(SourceFileName) as count, min(_time) as firstTime, max(_time) as lastTime by Workload,UserId,SiteUrl
    | rename SiteUrl as file_path,Workload as app
    | where count > 50
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `o365_exfiltration_via_file_sync_download_filter`
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
known_false_positives: It is possible that certain file sync scenarios may trigger this alert, specifically OneNote. Adjust threshold and filtering as needed.
references:
    - https://attack.mitre.org/techniques/T1567/exfil
    - https://www.varonis.com/blog/sidestepping-detection-while-exfiltrating-sharepoint-data
    - https://thedfirjournal.com/posts/m365-data-exfiltration-rclone/
drilldown_searches:
    - name: View the detection results for - "$user$"
      search: '%original_detection_search% | search user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
    - name: Investigate file sync downloads by $user$
      search: '`o365_management_activity` Operation IN ("filesyncdownload*") UserId="$UserId$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 20
          message: The user $user$ synced an excessive number of files [$count$] from $file_path$ using $src$
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Data Exfiltration
    - Office 365 Account Takeover
asset_type: O365 Tenant
mitre_attack_id:
    - T1567
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1567/o365_sus_file_activity/o365_sus_file_activity.log
          source: o365
          sourcetype: o365:management:activity
      test_type: unit