Cross-source coverage

T1213.002 / ATT&CK

Data from Information Repositories: Sharepoint

8 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

  • Policies, procedures, and standards
  • Physical / logical network diagrams
  • System architecture diagrams
  • Technical system documentation
  • Testing / development credentials (i.e., Unsecured Credentials)
  • Work / project schedules
  • Source code snippets
  • Links to network shares and other internal resources
Tactics
Collection
Platforms
Office Suite · Windows
Telemetry
m365:unifiedazure:signinlogsm365:sharepoint

How MITRE says to detect it DET0500

Detecting Abnormal SharePoint Data Mining by Privileged or Rare Users

Windows Analytic 1380

Privileged or rarely used accounts performing bulk access to SharePoint files or metadata over a short time window, indicating potential scripted collection of sensitive internal documents.

  • m365:unified FileAccessed, FileDownloaded, SearchQueried
  • azure:signinlogs UserLogin, ConditionalAccessPolicyEvaluated
  • m365:sharepoint Multiple file download operations on a site by a privileged account in a short time window

View on attack.mitre.org ↗

Wazuh Core Ruleset

4 rules
Detection Severity Format
Office 365: Suspicious download activity by user · rule 91724 High Wazuh XML
Office 365: Data loss protection (DLP) events in SharePoint and OneDrive for Business. Low Wazuh XML
Office 365: Events related to DLP classification in SharePoint. Low Wazuh XML
Office 365: SharePoint sharing events. Low Wazuh XML

elastic/detection-rules

3 rules
Detection Severity Format
M365 SharePoint/OneDrive File Access via PowerShell High Elastic TOML
Entra ID Sharepoint or OneDrive Accessed by Unusual Client Medium Elastic TOML
M365 SharePoint Search for Sensitive Content Low Elastic TOML

splunk/security_content

1 rule
Detection Severity Format
O365 SharePoint Suspicious Search Behavior Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.