Anvilogic critical experimental spl

O365 Anonymous Link Used [splunk-o365]

This use case detects when an anonymous sharing link is used to access files or folders in SharePoint Online or OneDrive for Business. These links allow external users to access shared content without authentication, meaning anyone with the link can access the resource, making it a potential security risk if not managed carefully. A threat actor could abuse the anonymous link functionality to gain access to sensitive data, bypass authentication mechanisms, and exfiltrate information.

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_o365` "AnonymousLinkUsed"
| table _time, host, user,account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id
| bin span=1s
| stats values(*) as * by _time, user

Field Validations

Loading…

Comments (0)

Loading comments...