O365_SharePoint_OneDrive_FileUploaded

ID: 100225

Description:

A behavior rule to track Sharepoint, specifically OneDrive, FileUploaded events in Office365 Audit logs.

This rule will trigger when a user performs file upload operations from a different location than normal. This could be an indicator of compromise, or a company policy violation.

This rule will trigger when the number of events per one (1) hour exceeds 20. This indicates that a particular user may be quickly uploading larger number of files than would be expected. Possible false positives occur when sync/backup operations occur, or when a particular user normally handles larger number of files in Office365.

Notes: Corresponding rule O365_SharePoint_OneDrive_FileUploaded_Multiple tracks multiple / greater-than-expected number of events related to Office365 SharePoint (OneDrive) file uploads

Repository: Fluency Group: Office365 Type: event

Default Status:

Enabled

Selector:

Query:

Filters:

Behavior Rule:

Risks:

Attributes:

Correlation Rules:

First Occurrence:

History:

This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)