Data from Information Repositories

// Detect bulk document access / data mining from SharePoint, OneDrive, and Microsoft Teams
let BulkAccessThreshold = 50;
let SensitiveKeywords = dynamic(["password", "credential", "secret", "vpn", "firewall", "network diagram",
  "architecture", "api key", "token", "private key", "ssn", "social security",
  "salary", "payroll", "customer data", "pii", "database", "connection string"]);
let TimeWindow = 1h;
// Branch 1: Bulk file access / download from SharePoint or OneDrive
let BulkAccess =
  OfficeActivity
  | where TimeGenerated > ago(24h)
  | where Workload in ("SharePoint", "OneDrive")
  | where Operation in ("FileDownloaded", "FileSyncDownloadedFull", "FileAccessed", "FilePreviewed", "FileSyncUploadedFull")
  | summarize
      OperationCount = count(),
      UniqueFiles = dcount(OfficeObjectId),
      UniqueExtensions = dcount(tostring(split(OfficeObjectId, ".")[-1])),
      Operations = make_set(Operation, 10),
      SourceIPs = make_set(ClientIP, 10),
      SiteUrls = make_set(Site_Url, 10),
      EarliestAccess = min(TimeGenerated),
      LatestAccess = max(TimeGenerated)
      by UserId, bin(TimeGenerated, TimeWindow)
  | where OperationCount >= BulkAccessThreshold
  | extend AccessDurationMinutes = datetime_diff('minute', LatestAccess, EarliestAccess)
  | extend FilesPerMinute = iff(AccessDurationMinutes > 0, toreal(UniqueFiles) / toreal(AccessDurationMinutes), toreal(UniqueFiles))
  | extend DetectionType = "BulkFileAccess"
  | project TimeGenerated, UserId, DetectionType, OperationCount, UniqueFiles, FilesPerMinute, Operations, SourceIPs, SiteUrls;
// Branch 2: Sensitive keyword searches in SharePoint
let SensitiveSearch =
  OfficeActivity
  | where TimeGenerated > ago(24h)
  | where Workload == "SharePoint"
  | where Operation == "SearchQueryPerformed"
  | where tolower(tostring(SearchQuery)) has_any (SensitiveKeywords)
  | summarize
      SearchCount = count(),
      UniqueQueries = dcount(SearchQuery),
      QuerySamples = make_set(SearchQuery, 5),
      SourceIPs = make_set(ClientIP, 5)
      by UserId, bin(TimeGenerated, TimeWindow)
  | extend DetectionType = "SensitiveKeywordSearch"
  | extend OperationCount = SearchCount
  | project TimeGenerated, UserId, DetectionType, OperationCount, UniqueQueries, QuerySamples, SourceIPs;
// Branch 3: External sharing of documents from SharePoint/OneDrive
let ExternalSharing =
  OfficeActivity
  | where TimeGenerated > ago(24h)
  | where Workload in ("SharePoint", "OneDrive")
  | where Operation in ("SharingInvitationCreated", "AnonymousLinkCreated", "SecureLinkCreated", "AddedToSecureLink")
  | extend IsExternalShare = ExternalAccess == true or Operation == "AnonymousLinkCreated"
  | where IsExternalShare == true
  | summarize
      ShareCount = count(),
      UniqueFiles = dcount(OfficeObjectId),
      TargetAccounts = make_set(TargetUserOrGroupName, 10),
      SiteUrls = make_set(Site_Url, 5)
      by UserId, bin(TimeGenerated, TimeWindow)
  | where ShareCount >= 5
  | extend DetectionType = "BulkExternalSharing"
  | extend OperationCount = ShareCount
  | project TimeGenerated, UserId, DetectionType, OperationCount, UniqueFiles, TargetAccounts, SiteUrls;
// Union all branches
BulkAccess
| union SensitiveSearch
| union ExternalSharing
| sort by OperationCount desc

| tstats count as OperationCount, dc(Office365.ObjectId) as UniqueFiles, values(Office365.Operation) as Operations, values(Office365.ClientIP) as SourceIPs
  from datamodel=Office365 where (Office365.Workload="SharePoint" OR Office365.Workload="OneDrive")
  AND (Office365.Operation="FileDownloaded" OR Office365.Operation="FileSyncDownloadedFull" OR Office365.Operation="FileAccessed" OR Office365.Operation="FilePreviewed")
  by Office365.UserId _time span=1h
| rename Office365.UserId as UserId
| where OperationCount >= 50
| eval RiskLevel=case(OperationCount >= 500, "Critical", OperationCount >= 200, "High", OperationCount >= 50, "Medium", true(), "Low")
| eval DetectionBranch="BulkFileAccess"
| table _time, UserId, OperationCount, UniqueFiles, Operations, SourceIPs, RiskLevel, DetectionBranch

`comment("--- Branch 2: Sensitive keyword searches ---")`

| search index=o365 sourcetype="o365:management:activity"
    (Workload="SharePoint" OR Workload="OneDrive")
    Operation="SearchQueryPerformed"
    (SearchQuery="*password*" OR SearchQuery="*credential*" OR SearchQuery="*vpn*"
     OR SearchQuery="*api key*" OR SearchQuery="*secret*" OR SearchQuery="*private key*"
     OR SearchQuery="*connection string*" OR SearchQuery="*network diagram*"
     OR SearchQuery="*architecture*" OR SearchQuery="*payroll*" OR SearchQuery="*salary*")
| stats count as SearchCount, dc(SearchQuery) as UniqueQueries, values(SearchQuery) as QuerySamples, values(ClientIP) as SourceIPs by UserId
| where SearchCount >= 3
| eval RiskLevel="High", DetectionBranch="SensitiveKeywordSearch"
| table UserId, SearchCount, UniqueQueries, QuerySamples, SourceIPs, RiskLevel, DetectionBranch

`comment("Note: Combine both result sets in production using append or union. Branch 2 uses raw search due to SearchQuery field not being in default O365 datamodel.")`

sequence by user.name with maxspan=1h
  [any where event.dataset == "o365.audit" and event.provider == "SharePoint" and event.action in ("FileDownloaded", "FileSyncDownloadedFull", "FileAccessed", "FilePreviewed") ] with runs=50

// Branch 2: Sensitive keyword searches
// Run separately:
// any where event.dataset == "o365.audit" and event.provider == "SharePoint" and event.action == "SearchQueryPerformed" and
//   wildcard(o365.audit.SearchQuery, "*password*", "*credential*", "*secret*", "*vpn*", "*api key*", "*private key*", "*connection string*", "*network diagram*", "*architecture*", "*payroll*", "*salary*")

// Branch 3: Bulk external sharing
// any where event.dataset == "o365.audit" and event.provider in ("SharePoint", "OneDrive") and
//   event.action in ("SharingInvitationCreated", "AnonymousLinkCreated", "SecureLinkCreated") ] with runs=5

-- Branch 1: Bulk file access from SharePoint/OneDrive
SELECT
  USERNAME AS UserId,
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm') AS EventWindow,
  COUNT(*) AS OperationCount,
  COUNT(DISTINCT "URL") AS UniqueFiles,
  QIDNAME(qid) AS EventName,
  CATEGORYNAME(category) AS CategoryName,
  LOGSOURCENAME(logsourceid) AS LogSource,
  ARRAY_AGG(DISTINCT sourceip) AS SourceIPs,
  CASE
    WHEN COUNT(*) >= 500 THEN 'Critical'
    WHEN COUNT(*) >= 200 THEN 'High'
    WHEN COUNT(*) >= 50 THEN 'Medium'
    ELSE 'Low'
  END AS RiskLevel
FROM events
WHERE
  LOGSOURCETYPEID = 397
  AND LOWER("Application") IN ('sharepoint', 'onedrive')
  AND LOWER("Operation") IN ('filedownloaded', 'filesyncdownloadedfull', 'fileaccessed', 'filepreviewed', 'filesyncuploadedfull')
  AND starttime > (CURRENT_TIMESTAMP - 86400000)
GROUP BY
  USERNAME,
  TRUNCATE(starttime, 3600000)
HAVING COUNT(*) >= 50
ORDER BY OperationCount DESC

-- Branch 2: Sensitive keyword searches (run as separate query)
-- SELECT USERNAME, COUNT(*) AS SearchCount, ARRAY_AGG(DISTINCT "SearchQuery") AS Queries, ARRAY_AGG(DISTINCT sourceip) AS SourceIPs
-- FROM events
-- WHERE LOGSOURCETYPEID = 397 AND LOWER("Application") = 'sharepoint' AND LOWER("Operation") = 'searchqueryperformed'
-- AND (LOWER("SearchQuery") LIKE '%password%' OR LOWER("SearchQuery") LIKE '%credential%' OR LOWER("SearchQuery") LIKE '%vpn%'
--   OR LOWER("SearchQuery") LIKE '%api key%' OR LOWER("SearchQuery") LIKE '%secret%' OR LOWER("SearchQuery") LIKE '%private key%'
--   OR LOWER("SearchQuery") LIKE '%connection string%' OR LOWER("SearchQuery") LIKE '%network diagram%'
--   OR LOWER("SearchQuery") LIKE '%architecture%' OR LOWER("SearchQuery") LIKE '%payroll%' OR LOWER("SearchQuery") LIKE '%salary%')
-- AND starttime > (CURRENT_TIMESTAMP - 86400000)
-- GROUP BY USERNAME HAVING COUNT(*) >= 3

// Branch 1: Bulk file access from SharePoint/OneDrive
_sourceCategory=office365 OR _sourceCategory=o365
| json field=_raw "Workload" as Workload
| json field=_raw "Operation" as Operation
| json field=_raw "UserId" as UserId
| json field=_raw "ObjectId" as ObjectId nodrop
| json field=_raw "ClientIP" as ClientIP nodrop
| json field=_raw "SiteUrl" as SiteUrl nodrop
| where Workload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull", "FileAccessed", "FilePreviewed", "FileSyncUploadedFull")
| timeslice 1h
| count as OperationCount, dcount(ObjectId) as UniqueFiles, values(ClientIP) as SourceIPs, values(SiteUrl) as SiteUrls by UserId, _timeslice
| where OperationCount >= 50
| if (OperationCount >= 500, "Critical", if(OperationCount >= 200, "High", if(OperationCount >= 50, "Medium", "Low"))) as RiskLevel
| fields _timeslice, UserId, OperationCount, UniqueFiles, SourceIPs, SiteUrls, RiskLevel
| sort by OperationCount desc

// Branch 2: Sensitive keyword searches — run as separate query:
// _sourceCategory=office365
// | json field=_raw "Workload" as Workload
// | json field=_raw "Operation" as Operation
// | json field=_raw "UserId" as UserId
// | json field=_raw "SearchQuery" as SearchQuery nodrop
// | json field=_raw "ClientIP" as ClientIP nodrop
// | where Workload = "SharePoint" and Operation = "SearchQueryPerformed"
// | where matches(toLowerCase(SearchQuery), ".*(?:password|credential|secret|vpn|api.key|private.key|connection.string|network.diagram|architecture|payroll|salary).*")
// | count as SearchCount, dcount(SearchQuery) as UniqueQueries, values(SearchQuery) as QuerySamples, values(ClientIP) as SourceIPs by UserId
// | where SearchCount >= 3
// | fields UserId, SearchCount, UniqueQueries, QuerySamples, SourceIPs

rule t1213_data_from_information_repositories {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects bulk file access/download from SharePoint or OneDrive exceeding 50 operations per hour, sensitive keyword searches, and bulk external sharing — indicators of adversarial data mining from information repositories (T1213)"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1213"
    mitre_attack_subtechnique = "T1213.002"
    severity = "HIGH"
    confidence = "MEDIUM"
    created = "2024-01-01"
    version = "1.0"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_name = /(?i)sharepoint|onedrive|office 365/
    $e.target.application = /(?i)sharepoint|onedrive/
    $e.metadata.product_event_type = /(?i)FileDownloaded|FileSyncDownloadedFull|FileAccessed|FilePreviewed|FileSyncUploadedFull/
    $e.principal.user.userid = $user
    $e.metadata.event_timestamp.seconds > 0

  match:
    $user over 1h

  outcome:
    $operation_count = count_distinct($e.metadata.product_event_type)
    $unique_files = count_distinct($e.target.url)
    $source_ips = array_distinct($e.principal.ip)
    $risk_level = if($operation_count >= 500, "Critical",
                   if($operation_count >= 200, "High",
                   if($operation_count >= 50, "Medium", "Low")))

  condition:
    #e >= 50
}

// Companion rule for sensitive keyword searches:
// rule t1213_sensitive_keyword_search {
//   meta:
//     description = "Detects sensitive keyword searches in SharePoint indicative of credential or architecture harvesting"
//     mitre_attack_technique = "T1213"
//   events:
//     $e.metadata.event_type = "USER_RESOURCE_ACCESS"
//     $e.metadata.product_name = /(?i)sharepoint/
//     $e.metadata.product_event_type = "SearchQueryPerformed"
//     $e.target.resource.name = /(?i)password|credential|secret|vpn|api.key|private.key|connection.string|network.diagram|architecture|payroll|salary/
//     $e.principal.user.userid = $user
//   match:
//     $user over 1h
//   condition:
//     #e >= 3
// }

// Branch 1: Bulk SharePoint/OneDrive file access via Office 365 activity events
// CrowdStrike ingests O365 audit logs via the Falcon Data Replicator or third-party connector
#event_simpleName=O365AuditEvent
| Workload = /SharePoint|OneDrive/i
| Operation = /FileDownloaded|FileSyncDownloadedFull|FileAccessed|FilePreviewed|FileSyncUploadedFull/i
| groupBy([UserId, timebucket(field=timestamp, bucket="1h")], function=[
    count(as=OperationCount),
    count(ObjectId, distinct=true, as=UniqueFiles),
    collect([Operation], limit=10, as=Operations),
    collect([ClientIP], limit=10, as=SourceIPs),
    collect([SiteUrl], limit=5, as=SiteUrls)
  ])
| OperationCount >= 50
| RiskLevel := if(OperationCount >= 500, "Critical",
               if(OperationCount >= 200, "High",
               if(OperationCount >= 50, "Medium", "Low")))
| DetectionBranch := "BulkFileAccess"
| sort(OperationCount, order=desc)
| select([timebucket, UserId, OperationCount, UniqueFiles, Operations, SourceIPs, SiteUrls, RiskLevel, DetectionBranch])

// Branch 2: Sensitive keyword searches — run as separate saved query:
// #event_simpleName=O365AuditEvent
// | Workload = /SharePoint/i
// | Operation = "SearchQueryPerformed"
// | SearchQuery = /password|credential|secret|vpn|api.key|private.key|connection.string|network.diagram|architecture|payroll|salary/i
// | groupBy([UserId], function=[
//     count(as=SearchCount),
//     count(SearchQuery, distinct=true, as=UniqueQueries),
//     collect([SearchQuery], limit=5, as=QuerySamples),
//     collect([ClientIP], limit=5, as=SourceIPs)
//   ])
// | SearchCount >= 3
// | DetectionBranch := "SensitiveKeywordSearch"
// | select([UserId, SearchCount, UniqueQueries, QuerySamples, SourceIPs, DetectionBranch])