Data from Information Repositories: Sharepoint `T1213.002`

Tactic: Collection

Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (17 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	3	`eq` 3	`o365.audit`, `azure.signinlogs`
`event.outcome`	3	`eq` 3	`success`
`EventType`	2	`eq` 1, `in` 1	`SearchQueryPerformed`, `fileaccessed`, `filedownloaded`
`Provider_Name`	2	`eq` 1, `in` 1	`SharePoint`, `onedrive`, `sharepoint`
`EventData`	1	`contains` 1	`search`
`Operation`	1	`eq` 1	`searchqueryinitiatedsharepoint`, `searchqueryperformed`
`SearchQueryText`	1	`eq` 1	`*`
`Workload`	1	`eq` 1	`sharepoint`
`aws::userAgent`	1	`contains` 1	`pnpcoresdk`, `pnpps`, `powershell`
`azure.signinlogs.properties.tenant_id`	1	`is_not_null` 1
`azure_ad::app_id`	1	`is_not_null` 1
`azure_ad::resource_id`	1	`in` 1	`00000003-0000-0ff1-ce00-000000000000`, `6a9b9266-8161-4a7b-913a-a9eda19da220`
`command`	1	`ne` 1	`()`, ``
`count`	1	`gt` 1	`20`
`o365.audit.SearchQueryText`	1	`contains` 1, `is_not_null` 1, `ne` 1	`1099`, `access key`, `account number`

Top indicator values (105 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client elasticM365 SharePoint Search for Sensitive Content elasticM365 SharePoint/OneDrive File Access via PowerShell	3	375
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 SharePoint Search for Sensitive Content elasticM365 SharePoint/OneDrive File Access via PowerShell	2	47
`data_stream.dataset`	`eq`	`azure.signinlogs` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1	36
`EventData`	`contains`	`search` splunkO365 SharePoint Suspicious Search Behavior	1
`EventType`	`eq`	`SearchQueryPerformed` elasticM365 SharePoint Search for Sensitive Content	1
`EventType`	`in`	`fileaccessed` elasticM365 SharePoint/OneDrive File Access via PowerShell	1
`EventType`	`in`	`filedownloaded` elasticM365 SharePoint/OneDrive File Access via PowerShell	1
`Operation`	`eq`	`searchqueryinitiatedsharepoint` splunkO365 SharePoint Suspicious Search Behavior	1
`Operation`	`eq`	`searchqueryperformed` splunkO365 SharePoint Suspicious Search Behavior	1
`Provider_Name`	`eq`	`SharePoint` elasticM365 SharePoint Search for Sensitive Content	1
`Provider_Name`	`in`	`onedrive` elasticM365 SharePoint/OneDrive File Access via PowerShell	1	3
`Provider_Name`	`in`	`sharepoint` elasticM365 SharePoint/OneDrive File Access via PowerShell	1	3
`SearchQueryText`	`eq`	`*` splunkO365 SharePoint Suspicious Search Behavior	1
`Workload`	`eq`	`sharepoint` splunkO365 SharePoint Suspicious Search Behavior	1	2
`aws::userAgent`	`contains`	`pnpcoresdk` elasticM365 SharePoint/OneDrive File Access via PowerShell	1
`aws::userAgent`	`contains`	`pnpps` elasticM365 SharePoint/OneDrive File Access via PowerShell	1
`aws::userAgent`	`contains`	`powershell` elasticM365 SharePoint/OneDrive File Access via PowerShell	1
`aws::userAgent`	`contains`	`sharepointpnp` elasticM365 SharePoint/OneDrive File Access via PowerShell	1
`azure_ad::resource_id`	`in`	`00000003-0000-0ff1-ce00-000000000000` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1	2
`azure_ad::resource_id`	`in`	`6a9b9266-8161-4a7b-913a-a9eda19da220` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`command`	`ne`	`(*)` splunkO365 SharePoint Suspicious Search Behavior	1	2
`command`	`ne`	`*` splunkO365 SharePoint Suspicious Search Behavior	1	2
`count`	`gt`	`20` splunkO365 SharePoint Suspicious Search Behavior	1	6
`o365.audit.SearchQueryText`	`contains`	`1099` elasticM365 SharePoint Search for Sensitive Content	1
`o365.audit.SearchQueryText`	`contains`	`access key` elasticM365 SharePoint Search for Sensitive Content	1
`o365.audit.SearchQueryText`	`contains`	`account number` elasticM365 SharePoint Search for Sensitive Content	1
`o365.audit.SearchQueryText`	`contains`	`acquisition` elasticM365 SharePoint Search for Sensitive Content	1
`o365.audit.SearchQueryText`	`contains`	`admin` elasticM365 SharePoint Search for Sensitive Content	1
`o365.audit.SearchQueryText`	`contains`	`api key` elasticM365 SharePoint Search for Sensitive Content	1
`o365.audit.SearchQueryText`	`contains`	`apikey` elasticM365 SharePoint Search for Sensitive Content	1

Exclusions (9 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`azure.signinlogs.properties.app_owner_tenant_id`	`eq`	`f8cdef31-a31e-4b4a-93e4-5f571e91255a` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`00000003-0000-0ff1-ce00-000000000000` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`08e18876-6177-487e-b8b5-cf950c1e598c` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`5e3ce6c0-2b1f-4285-8d4b-75ee78787346` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`9199bf20-a13f-4107-85dc-02114787ef48` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`ab9b8c07-8f02-4f72-87fa-80105867a763` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`af124e86-4e96-495a-b70a-90f90ab96707` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::app_id`	`in`	`cc15fd57-2c6c-4117-a88c-83b1d56b4bbe` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1
`azure_ad::signin_category`	`eq`	`microsoftserviceprincipalsigninlogs` elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client	1

Data from Information Repositories: Sharepoint `T1213.002`

Authoring guide

Fields filtered most (17 distinct)

Top indicator values (105 distinct)

Exclusions (9 distinct)

Rules under this technique

Elastic 3 rules

Splunk 1 rule

Data from Information Repositories: Sharepoint T1213.002

Authoring guide

Fields filtered most (17 distinct)

Top indicator values (105 distinct)

Exclusions (9 distinct)

Rules under this technique

Elastic 3 rules

Splunk 1 rule

Data from Information Repositories: Sharepoint `T1213.002`