THREAT-Exfiltration-M365AnonymousShareLinks Microsoft Sentinel · KQL

Detect Data Exfiltration via Anonymous SharePoint/OneDrive Sharing Links in Microsoft Sentinel

Rather than uploading data to an external cloud storage account (T1537) or a third-party tool like rclone or Mega, an adversary — or a malicious/negligent insider — can exfiltrate data using Microsoft 365's own file-sharing feature: generating an 'Anyone' (anonymous) or externally-shared link for a SharePoint or OneDrive file or folder, then downloading it from an unmanaged device or forwarding the link outside the organization. Because the traffic never leaves Microsoft's infrastructure and no suspicious process or unusual outbound network connection is generated, this technique evades every process- and network-telemetry-based exfiltration detection (EDR process monitoring, DeviceNetworkEvents, proxy logs). Detection instead depends entirely on the Microsoft 365 Unified Audit Log (Office 365 Management Activity API), which records SharePoint/OneDrive sharing operations such as AnonymousLinkCreated, SharingInvitationCreated, AddedToSecureLink, and the corresponding *LinkUsed events when the link is subsequently accessed.

MITRE ATT&CK

Tactic
Exfiltration

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
// THREAT: Anonymous Sharing Link Exfiltration (Microsoft 365 Unified Audit Log)
// Requires the Office 365 data connector (OfficeActivity table) in Microsoft Sentinel
let SensitiveExt = dynamic([".xlsx", ".docx", ".pdf", ".csv", ".pst", ".zip", ".sql", ".pptx"]);
// Signal 1: burst of anonymous/external link creation by a single user
let LinkCreationBurst = OfficeActivity
| where TimeGenerated > ago(24h)
| where Workload =~ "SharePoint"
| where Operation in ("AnonymousLinkCreated", "SharingInvitationCreated", "AddedToSecureLink")
| summarize LinkCount=count(), Files=make_set(OfficeObjectId, 20), FirstLink=min(TimeGenerated), LastLink=max(TimeGenerated)
    by UserId, ClientIP
| where LinkCount >= 10
| extend Signal = "BulkAnonymousLinkCreation";
// Signal 2: anonymous link created for a sensitive file type
let SensitiveFileShare = OfficeActivity
| where TimeGenerated > ago(24h)
| where Workload =~ "SharePoint"
| where Operation =~ "AnonymousLinkCreated"
| where OfficeObjectId has_any (SensitiveExt)
| project TimeGenerated, UserId, ClientIP, OfficeObjectId
| extend Signal = "AnonymousLinkOnSensitiveFile";
// Signal 3: anonymous link accessed/used from an external or unrecognized IP shortly after creation
let LinkUsedExternally = OfficeActivity
| where TimeGenerated > ago(24h)
| where Workload =~ "SharePoint"
| where Operation =~ "AnonymousLinkUsed"
| project TimeGenerated, UserId, ClientIP, OfficeObjectId
| extend Signal = "AnonymousLinkAccessed";
LinkCreationBurst
| project TimeGenerated=LastLink, UserId, ClientIP, LinkCount, Files, Signal
| union (SensitiveFileShare | project TimeGenerated, UserId, ClientIP, LinkCount=1, Files=pack_array(OfficeObjectId), Signal)
| union (LinkUsedExternally | project TimeGenerated, UserId, ClientIP, LinkCount=1, Files=pack_array(OfficeObjectId), Signal)
| sort by TimeGenerated desc
high severity medium confidence

Detects potential data exfiltration via Microsoft 365 anonymous sharing links using the OfficeActivity table populated by the Office 365 Management Activity API. Signal 1 identifies a single user creating 10 or more anonymous/external sharing links within 24 hours (bulk sharing is atypical for normal collaboration). Signal 2 flags any anonymous link created directly on a sensitive file type (spreadsheets, PST exports, SQL dumps, archives). Signal 3 flags subsequent use of an anonymous link, which confirms the shared content was actually retrieved. All three signals are audit-log based — there is no corresponding process or network telemetry because the traffic stays within Microsoft's SaaS boundary.

Data Sources

Office 365 Management Activity API (Unified Audit Log)Microsoft Sentinel OfficeActivity tableSharePoint Online / OneDrive for Business audit events

Required Tables

OfficeActivity

False Positives & Tuning

  • External collaboration teams (sales, partnerships, legal) that routinely share proposals or contracts via anonymous links as part of normal business process
  • Marketing or communications staff distributing public-facing assets (brochures, press kits) via SharePoint anonymous links
  • Automated workflows (Power Automate flows) that generate sharing links as part of an approved business process

Other platforms for THREAT-Exfiltration-M365AnonymousShareLinks

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Create Anonymous Sharing Link via PnP PowerShell

    Expected signal: Office 365 Unified Audit Log: Operation=AnonymousLinkCreated, Workload=SharePoint, RecordType=SharePointSharingOperation, with the UserId and ObjectId of the test file.

  2. Test 2Bulk Anonymous Link Creation Simulation

    Expected signal: 12 AnonymousLinkCreated audit events for the same UserId within a short time window.

Last updated: 2026-07-14 Research depth: deep
References (4)

Response Playbook

Triage

  1. Identify what was shared: pull the ObjectId/file path from the audit event and determine data sensitivity — HR records, financial statements, source code, or customer data warrant immediate escalation.
  2. Determine the sharing scope: 'Anyone with the link' (fully anonymous, no authentication required) is materially higher risk than a link restricted to specific external recipients (SharingInvitationCreated to a named external email).
  3. Check whether the link has already been used (AnonymousLinkUsed event) — if so, identify the accessing IP and geolocate it; an access from an unexpected country or non-corporate ASN is a strong indicator of actual exfiltration rather than a benign share.
  4. Review the user's recent activity for context: is this consistent with their role (e.g., a salesperson sharing a proposal) or anomalous (e.g., an engineer sharing a customer database export)?
  5. Check for a resignation, HR case, or performance-improvement-plan flag on the user account — anonymous link bulk-sharing shortly before departure is a well-documented insider-exfiltration pattern.
  6. Correlate with Entra ID sign-in logs: was the sharing action performed from a managed corporate device or an unmanaged/unrecognized device?

Containment

  1. Revoke the specific anonymous link immediately via the SharePoint admin center or PnP PowerShell (Revoke-PnPSharingLink) — this invalidates the link without requiring the file owner's action.
  2. If bulk/mass sharing is confirmed, tighten the tenant-wide external sharing policy (e.g., restrict from 'Anyone' to 'Existing guests' or 'Only people in your organization') as an emergency control.
  3. Disable the user's account or suspend their sessions (Revoke-AzureADUserAllRefreshToken) if insider exfiltration is suspected and further action is imminent (e.g., known resignation).
  4. Notify the data owner and, if sensitive personal or regulated data was involved, the data protection officer/legal team to assess breach notification obligations.
  5. Review and, if necessary, purge cached/synced copies on any device where the link was opened (via OneDrive/SharePoint sync client management if the device is domain-joined).

Evidence Collection

  1. Unified Audit Log (Office 365 Management Activity API): full record for AnonymousLinkCreated, SharingInvitationCreated, AddedToSecureLink, and AnonymousLinkUsed events including UserId, ClientIP, ObjectId, and SharingType
  2. SharePoint/OneDrive file version history: confirm what version of the file was shared and whether it was modified around the time of sharing
  3. Entra ID sign-in logs: device compliance state, IP address, and application used for the sharing session
  4. Any Microsoft Purview / DLP alerts that may have already fired for the same file or user (sensitive information type matches)

Escalation Criteria

  • !Anonymous link created for a file classified as confidential/restricted, or containing detected sensitive information types (PII, financial, source code)
  • !Confirmed link access (AnonymousLinkUsed) from a non-corporate, unexpected geography or anonymizing infrastructure (VPN/proxy/Tor exit node)
  • !Bulk link creation (10+ in a short window) by a single user, especially one flagged for HR/resignation activity
  • !Pattern occurs across multiple users simultaneously, suggesting compromised credentials or a coordinated insider event rather than an isolated incident

Investigation Guide

Related Techniques

T1567 — Exfiltration Over Web Service (parent technique)T1567.002 — Exfiltration to Cloud Storage (contrast: third-party tools like rclone/Mega vs. native M365 sharing)T1537 — Transfer Data to Cloud Account (cross-account cloud transfer via APIs/SAS URIs)T1114.003 — Email Forwarding Rule (a common companion insider-exfil technique via mailbox rules)T1078.004 — Valid Accounts: Cloud Accounts (compromised credentials enabling the sharing action)

Forensic Artifacts

  • >Unified Audit Log entries: AnonymousLinkCreated, SharingInvitationCreated, AddedToSecureLink, SecureLinkUsed, AnonymousLinkUsed with full ClientIP and UserAgent
  • >SharePoint Online 'Sharing' report (admin center): list of all currently active anonymous links tenant-wide, useful for a point-in-time sweep
  • >Microsoft Purview DLP alerts (if configured) for sensitive information types matched during the sharing action
  • >Entra ID sign-in logs correlating the timestamp of the sharing action to a specific session, device, and IP
  • >Browser download history or OneDrive sync client logs on the accessing device if it is a corporate-managed endpoint

Tuning Guidance

The single biggest driver of false positives is legitimate business use of external sharing by sales, partnerships, legal, and marketing teams. Before enabling the bulk-creation threshold (10+ links/day), run the 30-day hunting query to identify and allowlist these known heavy users by department or security group rather than by individual account, since role changes are common. For the sensitive-file-extension signal, tune the extension list to match your organization's actual sensitive data formats (e.g., add .msg for exported emails, or CAD file extensions for engineering firms) and consider integrating with Microsoft Purview sensitivity labels if available — a label-aware version of this detection (alerting only on links created for files labeled Confidential or above) will have substantially fewer false positives than an extension-based heuristic. Tenant-wide, consider whether 'Anyone' links should be disabled entirely and replaced with 'Specific people' or 'Existing guests' as a preventive control, which would make this detection largely unnecessary.

Hunting Queries

30-day hunt establishing a baseline of the heaviest anonymous/external-link sharers in the tenant. Use this to identify users whose sharing volume is a persistent outlier rather than a one-off business need, and to build an allowlist of known legitimate high-volume sharers (e.g., marketing, partnerships) before enabling the real-time detection.

Hunting — KQL
kql 
OfficeActivity
| where TimeGenerated > ago(30d)
| where Workload =~ "SharePoint"
| where Operation in ("AnonymousLinkCreated", "SharingInvitationCreated")
| summarize LinksCreated=count(), Files=make_set(OfficeObjectId, 50), Days=dcount(bin(TimeGenerated, 1d))
    by UserId
| where LinksCreated > 20
| sort by LinksCreated desc
Hunting — SPL
spl 
index=o365 sourcetype="o365:management:activity" Workload=SharePoint
  (Operation="AnonymousLinkCreated" OR Operation="SharingInvitationCreated")
| stats count as LinksCreated, values(ObjectId) as Files, dc(_time) as Days by UserId
| where LinksCreated > 20
| sort - LinksCreated

Atomic Red Team Tests

Test 1 Create Anonymous Sharing Link via PnP PowerShell
windows

Creates an anonymous 'Anyone with the link' sharing link for a test file in a SharePoint document library, generating the AnonymousLinkCreated audit event used by this detection. Use a non-sensitive test file only.

Command

powershell 
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/test" -Interactive; New-PnPAnonymousLink -Path "/Shared Documents/df00tech-test.txt" -LinkKind AnonymousView -Expiration (Get-Date).AddDays(1)

Cleanup

powershell 
Revoke-PnPSharingLink -Path "/Shared Documents/df00tech-test.txt" -Confirm:$false

Expected Telemetry

Office 365 Unified Audit Log: Operation=AnonymousLinkCreated, Workload=SharePoint, RecordType=SharePointSharingOperation, with the UserId and ObjectId of the test file.

Expected Detection

KQL/SPL 'AnonymousLinkOnSensitiveFile' or bulk-creation signal fires depending on file extension and volume; a single test run against a non-sensitive .txt file will not match the sensitive-extension signal but confirms audit event ingestion.

Test 2 Bulk Anonymous Link Creation Simulation
windows

Simulates the bulk-sharing insider-exfiltration pattern by creating anonymous links for 12 test files in rapid succession, exceeding the detection's 10-link/24h threshold.

Command

powershell 
1..12 | ForEach-Object { New-PnPAnonymousLink -Path "/Shared Documents/df00tech-test-$_.txt" -LinkKind AnonymousView -Expiration (Get-Date).AddDays(1) }

Cleanup

powershell 
1..12 | ForEach-Object { Revoke-PnPSharingLink -Path "/Shared Documents/df00tech-test-$_.txt" -Confirm:$false }

Expected Telemetry

12 AnonymousLinkCreated audit events for the same UserId within a short time window.

Expected Detection

KQL/SPL 'BulkAnonymousLinkCreation' signal fires once LinkCount reaches the 10-link threshold within 24 hours.

Related Detections

Tactic Hub

TA0010Exfiltration

Detection Variants (1)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1567.002Exfiltration to Cloud Storage

Related Techniques

T1567Exfiltration Over Web ServiceT1567.002Exfiltration to Cloud StorageT1537Transfer Data to Cloud AccountT1114.003Email Forwarding RuleT1078.004Cloud Accounts

Same Tactic: Exfiltration

Popular Detections