Rule:
Office 365 OneDrive Malware File Upload
Purpose
Identifies the occurrence of files uploaded to OneDrive being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunity to gain initial access to other endpoints in the environment.
Objective
Ensure that malware file uploads to OneDrive are detected.
Test Workflow
How to test
Download a safe test malware file (e.g., EICAR test file used for AV testing).
Log in to OneDrive with the test user account.
Upload the EICAR test file to the OneDrive account.
Allow the OneDrive file-scanning engine time to scan the file.