Anvilogic critical experimental spl

O365 Sharing Link Created [splunk-o365]

This use case detects when a sharing link is created for files and folders in SharePoint Online or OneDrive for Business. These links allow external users to access shared content, making it a potential security risk if not managed carefully. A threat actor could abuse the shared link functionality to gain access to sensitive data, bypass authentication mechanisms, and exfiltrate information.

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_o365` "SharingLinkCreated" 
OR "AddedToSharingLink"
| table _time, host, user,account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id
| bin span=1s
| stats values(*) as * by _time, user

Field Validations

Loading…

Comments (0)

Loading comments...