Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive. List currently includes 'exe', 'inf', 'gzip', 'cmd', 'bat' file extensions. Additionally, identifies when a given user is uploading these files to another users workspace. This may be indication of a staging location for malware or other malicious activity.
| Attribute | Value |
|---|---|
| Type | Analytic Rule |
| Solution | Microsoft 365 |
| ID | d722831e-88f5-4e25-b106-4ef6e29f8c13 |
| Severity | Low |
| Status | Available |
| Kind | Scheduled |
| Tactics | CommandAndControl, LateralMovement |
| Techniques | T1105, T1570 |
| Required Connectors | Office365 |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
OfficeActivity |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊