Sharepoint

let BulkAccessThreshold = 30;
let SensitiveKeywords = dynamic(["password", "credential", "secret", "vpn", "network diagram", "architecture", "topology", "firewall", "infrastructure", "source code", "api key", "private key", "token", "certificate", "backup"]);
let LookbackWindow = 24h;
let BucketSize = 1h;
OfficeActivity
| where TimeGenerated > ago(LookbackWindow)
| where RecordType in ("SharePointFileOperation", "SharePoint", "SharePointListItemOperation", "SharePointSearch")
| where Operation in (
    "FileAccessed", "FileDownloaded", "FileAccessedExtended",
    "FilePreviewed", "FolderBrowsed", "SearchQueryPerformed",
    "ListItemAccessed", "PageViewed"
  )
| extend IsSensitiveFile = SourceFileName has_any (SensitiveKeywords)
| extend IsSearchOperation = Operation == "SearchQueryPerformed"
| summarize
    TotalEvents        = count(),
    FilesAccessed      = dcountif(SourceFileName, not(IsSearchOperation)),
    SearchesExecuted   = countif(IsSearchOperation),
    SensitiveFileHits  = countif(IsSensitiveFile),
    UniqueShareSites   = dcount(Site_Url),
    SiteList           = make_set(Site_Url, 10),
    OperationTypes     = make_set(Operation),
    UserAgentSample    = take_any(UserAgent),
    Earliest           = min(TimeGenerated),
    Latest             = max(TimeGenerated)
    by UserId, ClientIP, bin(TimeGenerated, BucketSize)
| where TotalEvents > BulkAccessThreshold or SensitiveFileHits > 3
| extend SessionDuration = Latest - Earliest
| extend RatePerMinute   = round(toreal(TotalEvents) / max_of(toreal(datetime_diff('minute', Latest, Earliest)), 1), 1)
| project
    TimeGenerated, UserId, ClientIP,
    TotalEvents, FilesAccessed, SearchesExecuted, SensitiveFileHits,
    UniqueShareSites, SiteList, OperationTypes,
    SessionDuration, RatePerMinute, UserAgentSample
| sort by SensitiveFileHits desc, TotalEvents desc

index=o365 sourcetype="ms:o365:management:activity" Workload=SharePoint
  (Operation=FileAccessed OR Operation=FileDownloaded OR Operation=FileAccessedExtended
   OR Operation=FilePreviewed OR Operation=FolderBrowsed OR Operation=SearchQueryPerformed
   OR Operation=ListItemAccessed OR Operation=PageViewed)
| eval IsSensitive=if(
    match(lower(SourceFileName), "(password|credential|secret|vpn|network.diagram|architecture|topology|firewall|infrastructure|source.code|api.key|private.key|token|certificate|backup)"),
    1, 0
  )
| eval IsSearch=if(Operation="SearchQueryPerformed", 1, 0)
| bin _time span=1h
| stats
    count                              as TotalEvents,
    dc(SourceFileName)                 as FilesAccessed,
    sum(IsSearch)                      as SearchesExecuted,
    sum(IsSensitive)                   as SensitiveFileHits,
    dc(Site)                           as UniqueShareSites,
    values(Site)                       as SiteList,
    values(Operation)                  as OperationTypes,
    first(UserAgent)                   as UserAgentSample,
    min(_time)                         as Earliest,
    max(_time)                         as Latest
    by UserId, ClientIP, _time
| where TotalEvents > 30 OR SensitiveFileHits > 3
| eval SessionDurationMin=round((Latest - Earliest) / 60, 1)
| eval RatePerMinute=round(TotalEvents / max(SessionDurationMin, 1), 1)
| table _time, UserId, ClientIP, TotalEvents, FilesAccessed, SearchesExecuted,
        SensitiveFileHits, UniqueShareSites, SiteList, OperationTypes,
        SessionDurationMin, RatePerMinute, UserAgentSample
| sort - SensitiveFileHits, - TotalEvents

sequence by user.name, source.ip with maxspan=1h
  [any where event.dataset == "o365.audit" and
   event.action : ("FileAccessed","FileDownloaded","FileAccessedExtended","SearchQueryPerformed") and
   event.provider == "SharePoint"]
  with runs=30

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime,
  "UserId" as UserId, "ClientIP" as ClientIP,
  COUNT(*) as TotalEvents,
  COUNT(DISTINCT "SourceFileName") as FilesAccessed,
  SUM(CASE WHEN LOWER("SourceFileName") LIKE '%password%' OR LOWER("SourceFileName") LIKE '%credential%'
           OR LOWER("SourceFileName") LIKE '%secret%' THEN 1 ELSE 0 END) as SensitiveFileHits,
  CASE WHEN COUNT(*) > 100 THEN 10
       WHEN COUNT(*) > 50 THEN 7
       WHEN SUM(CASE WHEN LOWER("SourceFileName") LIKE '%password%' THEN 1 ELSE 0 END) > 3 THEN 8
       ELSE 5 END as RiskScore
FROM events
WHERE "Operation" IN ('FileAccessed','FileDownloaded','FileAccessedExtended','FilePreviewed',
                       'SearchQueryPerformed','FolderBrowsed')
  AND "Workload" = 'SharePoint'
  AND devicetime > NOW() - 3600000
GROUP BY DATEFORMAT(FLOOR(devicetime/3600000)*3600000, 'yyyy-MM-dd HH:mm:ss'), "UserId", "ClientIP"
HAVING COUNT(*) > 30 OR SensitiveFileHits > 3
ORDER BY TotalEvents DESC

_sourceCategory=o365/audit
| json auto
| where Workload == "SharePoint"
| where Operation in ("FileAccessed","FileDownloaded","FileAccessedExtended","FilePreviewed","SearchQueryPerformed","FolderBrowsed")
| eval is_sensitive = if(matches(toLower(SourceFileName), "(password|credential|secret|vpn|api.key|network.diagram|architecture)"), 1, 0)
| timeslice 1h
| stats count as TotalEvents, dcount(SourceFileName) as FilesAccessed,
        sum(is_sensitive) as SensitiveFileHits, dcount(Site) as UniqueShareSites
        by UserId, ClientIP, _timeslice
| where TotalEvents > 30 OR SensitiveFileHits > 3
| sort by SensitiveFileHits desc, TotalEvents desc

rule sharepoint_bulk_collection {
  meta:
    author = "Detection Engineering"
    description = "Detects bulk SharePoint data collection activity (T1213.002)"
    severity = "HIGH"
    tactic = "TA0009"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_name = "Office 365"
    $e.target.application = "SharePoint"
    $e.metadata.product_event_type = /FileAccessed|FileDownloaded|SearchQueryPerformed/ nocase
    $user = $e.principal.user.userid
    $ip = $e.principal.ip

  match:
    $user, $ip over 1h

  outcome:
    $event_count = count_distinct($e.metadata.id)

  condition:
    $event_count > 30
}

#event_simpleName = "OAuthApplicationUsed"
| ApplicationName = /SharePoint/i
| stats count() as TotalEvents, dc(FileName) as FilesAccessed by UserName, RemoteAddressIP4, span(timestamp, 1h)
| where TotalEvents > 30
| eval RiskLevel = if(TotalEvents > 100, "critical", if(TotalEvents > 50, "high", "medium"))
| table timestamp, UserName, RemoteAddressIP4, TotalEvents, FilesAccessed, RiskLevel
| sort by TotalEvents desc