THREAT-Exfiltration-M365AnonymousShareLinks Elastic Security · Elastic

Detect Data Exfiltration via Anonymous SharePoint/OneDrive Sharing Links in Elastic Security

Rather than uploading data to an external cloud storage account (T1537) or a third-party tool like rclone or Mega, an adversary — or a malicious/negligent insider — can exfiltrate data using Microsoft 365's own file-sharing feature: generating an 'Anyone' (anonymous) or externally-shared link for a SharePoint or OneDrive file or folder, then downloading it from an unmanaged device or forwarding the link outside the organization. Because the traffic never leaves Microsoft's infrastructure and no suspicious process or unusual outbound network connection is generated, this technique evades every process- and network-telemetry-based exfiltration detection (EDR process monitoring, DeviceNetworkEvents, proxy logs). Detection instead depends entirely on the Microsoft 365 Unified Audit Log (Office 365 Management Activity API), which records SharePoint/OneDrive sharing operations such as AnonymousLinkCreated, SharingInvitationCreated, AddedToSecureLink, and the corresponding *LinkUsed events when the link is subsequently accessed.

MITRE ATT&CK

Tactic
Exfiltration

Elastic Detection Query

Elastic Security (Elastic)
eql 
any where event.dataset == "o365.audit" and o365.audit.Workload == "SharePoint" and (
  o365.audit.Operation == "AnonymousLinkCreated" or
  o365.audit.Operation == "SharingInvitationCreated" or
  o365.audit.Operation == "AddedToSecureLink" or
  o365.audit.Operation == "AnonymousLinkUsed"
)
high severity medium confidence

Detects Microsoft 365 SharePoint/OneDrive anonymous and external sharing link events ingested via the Elastic Office 365 integration (Filebeat/Elastic Agent o365 module), which maps Unified Audit Log records into the o365.audit.* ECS fields. Matches link-creation and link-usage operations for downstream aggregation by user and time window to surface bulk-sharing or sensitive-file-sharing patterns.

Data Sources

Elastic Agent Office 365 integrationMicrosoft 365 Unified Audit Log (Management Activity API)

Required Tables

logs-o365.audit-*

False Positives & Tuning

  • Sales, legal, and partnership teams sharing external-facing documents as part of normal business workflow
  • Automated Power Automate/SharePoint workflows generating links for approved processes

Other platforms for THREAT-Exfiltration-M365AnonymousShareLinks

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Create Anonymous Sharing Link via PnP PowerShell

    Expected signal: Office 365 Unified Audit Log: Operation=AnonymousLinkCreated, Workload=SharePoint, RecordType=SharePointSharingOperation, with the UserId and ObjectId of the test file.

  2. Test 2Bulk Anonymous Link Creation Simulation

    Expected signal: 12 AnonymousLinkCreated audit events for the same UserId within a short time window.

Last updated: 2026-07-14 Research depth: deep
References (4)

Response Playbook

Triage

  1. Identify what was shared: pull the ObjectId/file path from the audit event and determine data sensitivity — HR records, financial statements, source code, or customer data warrant immediate escalation.
  2. Determine the sharing scope: 'Anyone with the link' (fully anonymous, no authentication required) is materially higher risk than a link restricted to specific external recipients (SharingInvitationCreated to a named external email).
  3. Check whether the link has already been used (AnonymousLinkUsed event) — if so, identify the accessing IP and geolocate it; an access from an unexpected country or non-corporate ASN is a strong indicator of actual exfiltration rather than a benign share.
  4. Review the user's recent activity for context: is this consistent with their role (e.g., a salesperson sharing a proposal) or anomalous (e.g., an engineer sharing a customer database export)?
  5. Check for a resignation, HR case, or performance-improvement-plan flag on the user account — anonymous link bulk-sharing shortly before departure is a well-documented insider-exfiltration pattern.
  6. Correlate with Entra ID sign-in logs: was the sharing action performed from a managed corporate device or an unmanaged/unrecognized device?

Containment

  1. Revoke the specific anonymous link immediately via the SharePoint admin center or PnP PowerShell (Revoke-PnPSharingLink) — this invalidates the link without requiring the file owner's action.
  2. If bulk/mass sharing is confirmed, tighten the tenant-wide external sharing policy (e.g., restrict from 'Anyone' to 'Existing guests' or 'Only people in your organization') as an emergency control.
  3. Disable the user's account or suspend their sessions (Revoke-AzureADUserAllRefreshToken) if insider exfiltration is suspected and further action is imminent (e.g., known resignation).
  4. Notify the data owner and, if sensitive personal or regulated data was involved, the data protection officer/legal team to assess breach notification obligations.
  5. Review and, if necessary, purge cached/synced copies on any device where the link was opened (via OneDrive/SharePoint sync client management if the device is domain-joined).

Evidence Collection

  1. Unified Audit Log (Office 365 Management Activity API): full record for AnonymousLinkCreated, SharingInvitationCreated, AddedToSecureLink, and AnonymousLinkUsed events including UserId, ClientIP, ObjectId, and SharingType
  2. SharePoint/OneDrive file version history: confirm what version of the file was shared and whether it was modified around the time of sharing
  3. Entra ID sign-in logs: device compliance state, IP address, and application used for the sharing session
  4. Any Microsoft Purview / DLP alerts that may have already fired for the same file or user (sensitive information type matches)

Escalation Criteria

  • !Anonymous link created for a file classified as confidential/restricted, or containing detected sensitive information types (PII, financial, source code)
  • !Confirmed link access (AnonymousLinkUsed) from a non-corporate, unexpected geography or anonymizing infrastructure (VPN/proxy/Tor exit node)
  • !Bulk link creation (10+ in a short window) by a single user, especially one flagged for HR/resignation activity
  • !Pattern occurs across multiple users simultaneously, suggesting compromised credentials or a coordinated insider event rather than an isolated incident

Investigation Guide

Related Techniques

T1567 — Exfiltration Over Web Service (parent technique)T1567.002 — Exfiltration to Cloud Storage (contrast: third-party tools like rclone/Mega vs. native M365 sharing)T1537 — Transfer Data to Cloud Account (cross-account cloud transfer via APIs/SAS URIs)T1114.003 — Email Forwarding Rule (a common companion insider-exfil technique via mailbox rules)T1078.004 — Valid Accounts: Cloud Accounts (compromised credentials enabling the sharing action)

Forensic Artifacts

  • >Unified Audit Log entries: AnonymousLinkCreated, SharingInvitationCreated, AddedToSecureLink, SecureLinkUsed, AnonymousLinkUsed with full ClientIP and UserAgent
  • >SharePoint Online 'Sharing' report (admin center): list of all currently active anonymous links tenant-wide, useful for a point-in-time sweep
  • >Microsoft Purview DLP alerts (if configured) for sensitive information types matched during the sharing action
  • >Entra ID sign-in logs correlating the timestamp of the sharing action to a specific session, device, and IP
  • >Browser download history or OneDrive sync client logs on the accessing device if it is a corporate-managed endpoint

Tuning Guidance

The single biggest driver of false positives is legitimate business use of external sharing by sales, partnerships, legal, and marketing teams. Before enabling the bulk-creation threshold (10+ links/day), run the 30-day hunting query to identify and allowlist these known heavy users by department or security group rather than by individual account, since role changes are common. For the sensitive-file-extension signal, tune the extension list to match your organization's actual sensitive data formats (e.g., add .msg for exported emails, or CAD file extensions for engineering firms) and consider integrating with Microsoft Purview sensitivity labels if available — a label-aware version of this detection (alerting only on links created for files labeled Confidential or above) will have substantially fewer false positives than an extension-based heuristic. Tenant-wide, consider whether 'Anyone' links should be disabled entirely and replaced with 'Specific people' or 'Existing guests' as a preventive control, which would make this detection largely unnecessary.

Hunting Queries

30-day hunt establishing a baseline of the heaviest anonymous/external-link sharers in the tenant. Use this to identify users whose sharing volume is a persistent outlier rather than a one-off business need, and to build an allowlist of known legitimate high-volume sharers (e.g., marketing, partnerships) before enabling the real-time detection.

Hunting — KQL
kql 
OfficeActivity
| where TimeGenerated > ago(30d)
| where Workload =~ "SharePoint"
| where Operation in ("AnonymousLinkCreated", "SharingInvitationCreated")
| summarize LinksCreated=count(), Files=make_set(OfficeObjectId, 50), Days=dcount(bin(TimeGenerated, 1d))
    by UserId
| where LinksCreated > 20
| sort by LinksCreated desc
Hunting — SPL
spl 
index=o365 sourcetype="o365:management:activity" Workload=SharePoint
  (Operation="AnonymousLinkCreated" OR Operation="SharingInvitationCreated")
| stats count as LinksCreated, values(ObjectId) as Files, dc(_time) as Days by UserId
| where LinksCreated > 20
| sort - LinksCreated

Atomic Red Team Tests

Test 1 Create Anonymous Sharing Link via PnP PowerShell
windows

Creates an anonymous 'Anyone with the link' sharing link for a test file in a SharePoint document library, generating the AnonymousLinkCreated audit event used by this detection. Use a non-sensitive test file only.

Command

powershell 
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/test" -Interactive; New-PnPAnonymousLink -Path "/Shared Documents/df00tech-test.txt" -LinkKind AnonymousView -Expiration (Get-Date).AddDays(1)

Cleanup

powershell 
Revoke-PnPSharingLink -Path "/Shared Documents/df00tech-test.txt" -Confirm:$false

Expected Telemetry

Office 365 Unified Audit Log: Operation=AnonymousLinkCreated, Workload=SharePoint, RecordType=SharePointSharingOperation, with the UserId and ObjectId of the test file.

Expected Detection

KQL/SPL 'AnonymousLinkOnSensitiveFile' or bulk-creation signal fires depending on file extension and volume; a single test run against a non-sensitive .txt file will not match the sensitive-extension signal but confirms audit event ingestion.

Test 2 Bulk Anonymous Link Creation Simulation
windows

Simulates the bulk-sharing insider-exfiltration pattern by creating anonymous links for 12 test files in rapid succession, exceeding the detection's 10-link/24h threshold.

Command

powershell 
1..12 | ForEach-Object { New-PnPAnonymousLink -Path "/Shared Documents/df00tech-test-$_.txt" -LinkKind AnonymousView -Expiration (Get-Date).AddDays(1) }

Cleanup

powershell 
1..12 | ForEach-Object { Revoke-PnPSharingLink -Path "/Shared Documents/df00tech-test-$_.txt" -Confirm:$false }

Expected Telemetry

12 AnonymousLinkCreated audit events for the same UserId within a short time window.

Expected Detection

KQL/SPL 'BulkAnonymousLinkCreation' signal fires once LinkCount reaches the 10-link threshold within 24 hours.

Related Detections

Tactic Hub

TA0010Exfiltration

Detection Variants (1)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1567.002Exfiltration to Cloud Storage

Related Techniques

T1567Exfiltration Over Web ServiceT1567.002Exfiltration to Cloud StorageT1537Transfer Data to Cloud AccountT1114.003Email Forwarding RuleT1078.004Cloud Accounts

Same Tactic: Exfiltration

Popular Detections