M365 SharePoint Search for Sensitive Content

  1[metadata]
  2creation_date = "2026/02/24"
  3integration = ["o365"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies search queries in SharePoint containing sensitive terms related to credentials, financial data,
 11PII, legal matters, or infrastructure information. Adversaries who compromise user accounts often search for high-value
 12files before exfiltration. This rule detects searches containing terms across multiple sensitivity categories,
 13regardless of the access method (browser, PowerShell, or API). The actual search query text is analyzed against a
 14curated list of sensitive terms to identify potential reconnaissance activity.
 15"""
 16false_positives = [
 17    "Security or compliance teams using eDiscovery or Content Search for legitimate investigations.",
 18    "HR or finance personnel legitimately searching for employee or financial records.",
 19    "IT administrators searching for configuration or infrastructure documentation.",
 20    "Legal teams searching for contract or privileged documents.",
 21]
 22from = "now-9m"
 23index = ["filebeat-*", "logs-o365.audit-*"]
 24language = "eql"
 25license = "Elastic License v2"
 26name = "M365 SharePoint Search for Sensitive Content"
 27note = """## Triage and Analysis
 28
 29### Investigating M365 SharePoint Search for Sensitive Content
 30
 31This rule detects search queries in SharePoint or OneDrive that contain sensitive terms. The Microsoft 365 Unified Audit Log captures the actual search query text in the `SearchQueryText` field, allowing detection of reconnaissance activity targeting credentials, financial data, PII, legal documents, or infrastructure information.
 32
 33#### Possible Investigation Steps
 34
 35- Identify who performed the search and determine if this user has a legitimate business need to search for this type of content.
 36- Review the exact search terms used. Multiple sensitive terms in one query are more suspicious.
 37- Determine if the search was via browser, automation tool (PnP PowerShell), or API.
 38- Review the source IP and correlate with the user's typical access patterns.
 39- Look for subsequent file download or access events from the same user/session within minutes of the search.
 40- Determine if the user is a member of roles that would legitimately search for sensitive content (HR, Finance, Legal, Security, Compliance).
 41- Check Azure AD sign-in logs for authentication anomalies (device code flow, unusual location).
 42
 43### Response and Remediation
 44
 45- If unauthorized search activity is confirmed, immediately review what files were accessed or downloaded following the search.
 46- Revoke the user's session tokens and require reauthentication with MFA.
 47- If the account was compromised, reset credentials and investigate the compromise vector.
 48- Review Data Loss Prevention (DLP) policies to ensure sensitive content is properly protected.
 49- Consider implementing sensitivity labels and access restrictions on high-value content.
 50"""
 51references = ["https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft"]
 52risk_score = 21
 53rule_id = "4f2654e4-125b-11f1-af7d-f661ea17fbce"
 54severity = "low"
 55tags = [
 56    "Domain: Cloud",
 57    "Domain: SaaS",
 58    "Data Source: Microsoft 365",
 59    "Data Source: Microsoft 365 Audit Logs",
 60    "Use Case: Threat Detection",
 61    "Tactic: Discovery",
 62    "Tactic: Collection",
 63    "Resources: Investigation Guide",
 64    "Noise: Medium",
 65    "Performance: Normal",
 66    "Rule Type: Event Correlation (EQL)",
 67    "Platform: Microsoft 365",
 68    "Service: Microsoft SharePoint",
 69]
 70timestamp_override = "event.ingested"
 71type = "eql"
 72
 73query = '''
 74web where data_stream.dataset == "o365.audit" and
 75    event.provider == "SharePoint" and
 76    event.action == "SearchQueryPerformed" and
 77    event.outcome == "success" and
 78    o365.audit.SearchQueryText != null and
 79    o365.audit.SearchQueryText != "" and
 80    o365.audit.SearchQueryText like~ (
 81        /* Credentials and Secrets */
 82        "*password*", "*credential*", "*secret*", "*api key*", "*apikey*",
 83        "*token*", "*private key*", "*certificate*", "*ssh*", "*aws*",
 84        "*azure*", "*gcp*", "*oauth*", "*bearer*", "*connection string*",
 85        "*access key*", "*secret key*",
 86        /* Financial */
 87        "*salary*", "*payroll*", "*compensation*", "*budget*", "*revenue*",
 88        "*financial*", "*banking*", "*invoice*", "*wire transfer*", "*account number*",
 89        "*credit card*", "*routing number*", "*profit*", "*expense*", "*1099*",
 90        /* Legal and Compliance */
 91        "*confidential*", "*privileged*", "*attorney*", "*legal hold*", "*settlement*",
 92        "*contract*", "*nda*", "*merger*", "*acquisition*", "*litigation*",
 93        "*subpoena*", "*trade secret*", "*intellectual property*", "*proprietary*",
 94        "*internal*", "*proposal*", "*poc*",
 95        /* HR and PII */
 96        "*ssn*", "*social security*", "*employee*", "*personnel*", "*performance review*",
 97        "*termination*", "*tax*", "*w2*", "*benefits*", "*background check*",
 98        "*medical*", "*hipaa*", "*passport*", "*driver license*", "*dob*",
 99        /* Infrastructure and IT */
100        "*admin*", "*root*", "*vpn*", "*firewall*", "*network diagram*",
101        "*architecture*", "*topology*", "*production*", "*database*", "*config*",
102        "*backup*", "*disaster recovery*", "*vulnerability*", "*pentest*", "*security audit*",
103        "*salesforce*"
104    )
105'''
106
107[[rule.threat]]
108framework = "MITRE ATT&CK"
109[[rule.threat.technique]]
110id = "T1619"
111name = "Cloud Storage Object Discovery"
112reference = "https://attack.mitre.org/techniques/T1619/"
113
114[rule.threat.tactic]
115id = "TA0007"
116name = "Discovery"
117reference = "https://attack.mitre.org/tactics/TA0007/"
118
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121[[rule.threat.technique]]
122id = "T1213"
123name = "Data from Information Repositories"
124reference = "https://attack.mitre.org/techniques/T1213/"
125[[rule.threat.technique.subtechnique]]
126id = "T1213.002"
127name = "Sharepoint"
128reference = "https://attack.mitre.org/techniques/T1213/002/"
129
130[[rule.threat.technique]]
131id = "T1530"
132name = "Data from Cloud Storage"
133reference = "https://attack.mitre.org/techniques/T1530/"
134
135
136[rule.threat.tactic]
137id = "TA0009"
138name = "Collection"
139reference = "https://attack.mitre.org/tactics/TA0009/"