Rule
Office 365 SharePoint Malware File Upload
Purpose
Identifies the occurrence of files uploaded to SharePoint being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries an opportunity to gain initial access to other endpoints in the environment.
Objective
Ensure malware file uploads to SharePoint are detected.
How to test
Download a safe test malware file (e.g., the EICAR test file).
Login to the test SharePoint environment with a test user account.
Upload the test malware file to SharePoint.
Allow time for the file scanning engine to scan the file.