SharePoint file operations

Operation	Description	Sample	Rule
any	Catch-all for M365-SharePointFileOperation rules matching the RecordType but no specific Operation.	N	Y
FileAccessed	A user or application accessed (previewed or opened) a file in SharePoint Online or OneDrive without downloading it.	Y	Y
FileDeleted	A file was deleted from a SharePoint Online or OneDrive site.	Y	N
FileDownloaded	A file was downloaded from SharePoint Online or OneDrive to the user's local device.	Y	Y
FileMalwareDetected	SharePoint or OneDrive antivirus scanning detected malware in an uploaded or synced file.	Y	Y
FileModified	File Modified activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
FileMoved	File Moved activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
FileRecycled	File Recycled activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
FileRenamed	File Renamed activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
FileSyncDownloadedFull	A user established a sync relationship and successfully downloaded all files from a SharePoint Online / OneDrive document library to a computer (the "Microsoft SkyDriveSync" client). A SharePointFileOperation (RecordType 6) event, alongside the documented FileDownloaded / FileAccessed / FileUploaded operations. A primary bulk-exfiltration-via-sync signal.	Y	Y
FileSyncDownloadedPartial	A user established a sync relationship and downloaded part of a SharePoint Online / OneDrive document library to a computer (the "Microsoft SkyDriveSync" client). A SharePointFileOperation (RecordType 6) event, the partial-download complement of FileSyncDownloadedFull.	N	N
FileSyncUploadedFull	A file was uploaded to SharePoint or OneDrive by the OneDrive sync app (full upload).	Y	Y
FileUploaded	A file was uploaded to SharePoint Online or OneDrive.	Y	Y
FileVersionsAllDeleted	All versions of a file were deleted from a SharePoint Online or OneDrive site.	N	N
FolderCreated	Folder Created activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
FolderDeleted	A folder was deleted from a SharePoint Online or OneDrive site.	Y	N
FolderModified	Folder Modified activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
FolderRecycled	Folder Recycled activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).	Y	N
SearchQueryPerformed	A user or system account performed a search in SharePoint or OneDrive (listed under SharePoint file and page activities).	N	Y

any: SharePoint file operations (catch-all)

RecordType: SharePointFileOperation

Description

Catch-all for M365-SharePointFileOperation rules matching the RecordType but no specific Operation.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	1 detection rule	Splunk
`SiteUrl`	1 detection rule	Splunk
`UserAgent`	1 detection rule	Splunk

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`aws::userAgent` (splunk rule field)	contains	`skydrivesync`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

O365 Exfiltration via File Sync Download source: The following analytic detects when an excessive number of files are sync from o365 by the same user over a short period of time. A malicious actor abuse the user-agent string through GUI or API access to evade triggering the…T1530, T1567

References #

FileAccessed

RecordType: SharePointFileOperation

Description

A user or application accessed (previewed or opened) a file in SharePoint Online or OneDrive without downloading it.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	2 detection rules	Kusto, Splunk
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic
`FileAccessCount`	1 detection rule	Kusto
`principal.user.userid`	1 detection rule	YARA-L
`RecordType`	1 detection rule	Kusto
`SiteUrl`	1 detection rule	Splunk
`SourceFileExtension`	1 detection rule	Splunk
`SourceRelativeUrl`	1 detection rule	Kusto
`UserAgent`	1 detection rule	Elastic
`UserId`	1 detection rule	Splunk

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0012f3a9-e7d8-0cc6-9e02-415208cf4773",
    "ClientAppName": "Unknown",
    "CorrelationId": "fca77aa1-f0e3-0000-6bd5-6c2db325a092",
    "TokenIssuedAtTime": "2025-01-24T19:34:36",
    "UniqueTokenId": "z4DNXFjBcUyahgLIGIRHA3"
  },
  "CreationTime": "2025-01-24T19:41:21",
  "Id": "a4a1f35c-d16d-4d9a-a30b-08dd3c742073",
  "Operation": "FileAccessed",
  "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae",
  "RecordType": 6,
  "UserKey": "i:0h.f|membership|30012003c9b97d53@live.com",
  "UserType": 0,
  "Version": 1,
  "Workload": "SharePoint",
  "ClientIP": "167.123.189.143",
  "UserId": "normie11@attack_range.lan",
  "AuthenticationType": "FormsCookieAuth",
  "CorrelationId": "fca77aa1-f0e3-0000-6bd5-6c2db325a091",
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "IsManagedDevice": true,
  "ItemType": "File",
  "ListId": "208fcb81-1abc-4422-b2ff-4b8662964adf",
  "ListItemUniqueId": "c878fc54-2313-4454-8ba5-0c31e4911870",
  "Platform": "WinDesktop",
  "Site": "c7f8fb91-c3ff-4d8c-94ec-f8f1d697e028",
  "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0",
  "WebId": "c18b8c5f-f551-40c2-b6f1-a8429f89f3e3",
  "DeviceDisplayName": "2a01:111:2053:512::ad4:4d4e",
  "HighPriorityMediaProcessing": false,
  "ListBaseType": 1,
  "ListServerTemplate": 101,
  "SourceFileExtension": "xlsx",
  "SiteUrl": "https://attack_range.sharepoint.com/sites/CorporateInfo/",
  "SourceRelativeUrl": "Shared Documents/General/CorporateInfo",
  "SourceFileName": "CallList_5.xlsx",
  "ApplicationDisplayName": "Unknown",
  "ObjectId": "https://attack_range.sharepoint.com/sites/CorporateInfo/Shared Documents/General/CorporateInfo/CallList_5.xlsx"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`SubjectUserName` (chronicle rule field)	eq	`anonymous`	1 rule	chronicle
`SubjectUserName` (chronicle rule field)	regex_match	`^urn:spo:anon#`	1 rule	chronicle
`TimeDeleted` (kusto rule field)	cross_field_compare	`TimeAdded`	1 rule	kusto
`count` (splunk rule field)	gt	`50`	1 rule	splunk
`user` (splunk rule field)	ne	`app@sharepoint`	1 rule	splunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 SharePoint/OneDrive File Access via PowerShell source high: Identifies file downloads or access from OneDrive or SharePoint using PowerShell-based user agents. Adversaries may use native PowerShell cmdlets like Invoke-WebRequest or Invoke-RestMethod with Microsoft Graph API to exfiltrate data after compromising OAuth tokens via device code phishing or other credential theft techniques. This rule detects both direct PowerShell access and PnP PowerShell module usage for file operations. FileAccessed events are included to detect adversaries reading file content via API and saving locally, bypassing traditional download methods. Normal users access SharePoint/OneDrive via browsers or sync clients, making PowerShell-based file access inherently suspicious.T1059, T1059.001, T1213, T1213.002, T1530↳ also matches FileDownloaded

Splunk #

O365 Exfiltration via File Access source: The following analytic detects when an excessive number of files are access from o365 by the same user over a short period of time. A malicious actor may abuse the "open in app" functionality of SharePoint through scripted or Graph API…T1530, T1567

Kusto #

Accessed files shared by temporary external user source low: This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This might be an indicator of suspicious activity.T1566↳ also matches FileUploaded

YARA-L #

O365 OneDrive Anonymous File Accessed source medium: Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.T1048, T1048.002

References #

FileDeleted

RecordType: SharePointFileOperation

Description

A file was deleted from a SharePoint Online or OneDrive site.

Example Audit Record #

{
  "CreationTime": "2019-11-26T21:30:23",
  "Id": "*REDACTED*",
  "Operation": "FileDeleted",
  "OrganizationId": "*REDACTED*",
  "RecordType": 6,
  "UserKey": "*REDACTED*",
  "UserType": 0,
  "Version": 1,
  "Workload": "OneDrive",
  "ClientIP": "*REDACTED*",
  "ObjectId": "*REDACTED*",
  "UserId": "*REDACTED*",
  "CorrelationId": "*REDACTED*",
  "EventSource": "SharePoint",
  "ItemType": "File",
  "ListId": "*REDACTED*",
  "ListItemUniqueId": "*REDACTED*",
  "Site": "*REDACTED*",
  "UserAgent": "*REDACTED*",
  "WebId": "*REDACTED*",
  "SourceFileExtension": "pptx",
  "SiteUrl": "*REDACTED*",
  "SourceFileName": "*REDACTED*",
  "SourceRelativeUrl": "*REDACTED*"
}

References #

FileDownloaded

RecordType: SharePointFileOperation

Description

A file was downloaded from SharePoint Online or OneDrive to the user's local device.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	6 detection rules	Kusto, Splunk
`UserAgent`	3 detection rules	Elastic, Kusto
`Workload`	3 detection rules	Kusto
`event.action`	2 detection rules	Elastic
`event.outcome`	2 detection rules	Elastic
`event.provider`	2 detection rules	Elastic
`EventSource`	2 detection rules	Kusto
`principal.user.userid`	2 detection rules	YARA-L
`RecordType`	2 detection rules	Kusto
`ApplicationId`	1 detection rule	Elastic
`user.id`	1 detection rule	Elastic

Example Audit Record #

{
  "AppAccessContext": {
    "ClientAppId": "00000003-0000-0ff1-ce00-000000000000",
    "ClientAppName": "Office 365 SharePoint Online",
    "CorrelationId": "798777a1-806a-0000-6bd5-627f44e59f2e",
    "TokenIssuedAtTime": "2025-01-24T19:21:37",
    "UniqueTokenId": "mbWC1n6bWEeuOfbKJqcjAA"
  },
  "CreationTime": "2025-01-24T19:29:22",
  "Id": "eb207561-ba3e-4b9b-4806-08dd34d1bf87",
  "Operation": "FileDownloaded",
  "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae",
  "RecordType": 6,
  "UserKey": "i:0h.f|membership|30022001f74eedd0@live.com",
  "UserType": 0,
  "Version": 1,
  "Workload": "SharePoint",
  "ClientIP": "111.132.198.127",
  "UserId": "attacker2@attack_range.lan",
  "ApplicationId": "00000003-0000-0ff1-ce00-000000000000",
  "AuthenticationType": "OAuth",
  "CorrelationId": "798777a1-806a-0000-6bd5-627f44e59f2e",
  "DoNotDistributeEvent": true,
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "IsManagedDevice": true,
  "ItemType": "File",
  "ListId": "1c502ccd-c251-4769-bfb4-3c9a46525f55",
  "ListItemUniqueId": "dfea6df8-5a7d-4422-bb09-2b235e4e29c7",
  "Platform": "Service",
  "Site": "feac8bb6-4e6e-49a7-b098-e866c9eb1a6f",
  "UserAgent": "OneDriveMpc-Transform_Zip/1.0",
  "UserSessionId": "9c771a6e-9062-4810-ab4c-0d0a3d238c39",
  "WebId": "06a230a4-3525-48c2-9ca5-8fb7794dadda",
  "DeviceDisplayName": "4.236.236.70",
  "EventSignature": "1.CAESDkZpbGVEb3dubG9hZGVkGJL2mrwGIhAxMDAzMjAwMWY3NGVlZGQwKiQwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAyEgm2i6z-bk6nSRGwmOhmyesabzoSCaQwogYlNcJIEZylj7d5Ta3aQhIJzSxQHFHCaUcRv7Q8mkZSX1VKEgn4berffVoiRBG7CSsjXk4pxw.2Gw9d8ihUUb4qqw3bcC3aWREnBf9EdgCHBCgHY23m8A",
  "FileSizeBytes": 19639521,
  "HighPriorityMediaProcessing": false,
  "ListBaseType": 1,
  "ListServerTemplate": 101,
  "SourceFileExtension": "docx",
  "ZipFileName": "OneDrive_1_1-14-2025.zip",
  "SiteUrl": "https://attack_range.sharepoint.com/sites/CorporateSecretsManagement/",
  "SourceRelativeUrl": "Shared Documents/General/ProprietaryInfo",
  "SourceFileName": "ProductionFormula_9.docx",
  "ApplicationDisplayName": "Office 365 SharePoint Online",
  "ObjectId": "https://attack_range.sharepoint.com/sites/CorporateSecretsManagement/Shared Documents/General/ProprietaryInfo/ProductionFormula_9.docx"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`Deviation` (kusto rule field)	gt	`25`	2 rules	kusto
`SubjectUserName` (chronicle rule field)	eq	`anonymous`	1 rule	chronicle
`SubjectUserName` (chronicle rule field)	regex_match	`^urn:spo:anon#`	1 rule	chronicle
`count` (splunk rule field)	gt	`50`	1 rule	splunk
`m365::ApplicationId` (elastic rule field)	is_not_null		1 rule	elastic
`network.http.method (Chronicle)`	eq	`GET`	1 rule	chronicle
`user.id` (elastic rule field)	is_not_null		1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 OneDrive/SharePoint Excessive File Downloads source medium: Identifies when an excessive number of files are downloaded from OneDrive or SharePoint by an authorized user or application in a short period of time. This may indicate a potential data exfiltration event, especially if the downloads are performed using OAuth authentication which could suggest an OAuth phishing attack such as Device Code Authentication phishing.T1020, T1530, T1567
M365 SharePoint/OneDrive File Access via PowerShell source high: Identifies file downloads or access from OneDrive or SharePoint using PowerShell-based user agents. Adversaries may use native PowerShell cmdlets like Invoke-WebRequest or Invoke-RestMethod with Microsoft Graph API to exfiltrate data after compromising OAuth tokens via device code phishing or other credential theft techniques. This rule detects both direct PowerShell access and PnP PowerShell module usage for file operations. FileAccessed events are included to detect adversaries reading file content via API and saving locally, bypassing traditional download methods. Normal users access SharePoint/OneDrive via browsers or sync clients, making PowerShell-based file access inherently suspicious.T1059, T1059.001, T1213, T1213.002, T1530↳ also matches FileAccessed

Splunk #

O365 Exfiltration via File Download source: The following analytic detects when an excessive number of files are downloaded from o365 by the same user over a short period of time. O365 may bundle these files together as a ZIP file, however each file will have it's own download…T1530, T1567

Kusto #

SharePointFileOperation via previously unseen IPs source medium: Identifies anomalies using user behavior by setting a threshold for significant changes in file upload/download activities from new IP addresses. It establishes a baseline of typical behavior, compares it to recent activity, and flags deviations exceeding a default threshold of 25.T1030↳ also matches FileUploaded
SharePointFileOperation via devices with previously unseen user agents source medium: Identifies anomalies if the number of documents uploaded or downloaded from device(s) associated with a previously unseen user agent exceeds a threshold (default is 5) and deviation (default is 25).T1030↳ also matches FileUploaded
Office365 Sharepoint File transfer above threshold source medium: Identifies Office365 Sharepoint File Transfers above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.T1020↳ also matches FileSyncDownloadedFull, FileSyncUploadedFull, FileUploaded

Show 2 more (5 total) on the rules page

YARA-L #

Hunt for Non-Anonymous Office 365 file downloads source low: Detects file downloads using O365 or Graph Activity logs, not including anonymous file linksT1048, T1048.002
O365 OneDrive Anonymous File Downloaded source medium: Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to download files from OneDrive.T1048, T1048.002

References #

FileMalwareDetected

RecordType: SharePointFileOperation

Description

SharePoint or OneDrive antivirus scanning detected malware in an uploaded or synced file.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.action`	2 detection rules	Elastic
`event.provider`	2 detection rules	Elastic
`Operation`	1 detection rule	Splunk

Example Audit Record #

{
  "AppAccessContext": {
    "ClientAppId": "00000007-0000-0ff1-ce00-000000000000",
    "ClientAppName": "00000007-0000-0ff1-ce00-000000000000",
    "CorrelationId": "74f816a1-500e-0000-03f9-86a19a6727cf"
  },
  "ApplicationDisplayName": "00000007-0000-0ff1-ce00-000000000000",
  "ApplicationId": "00000007-0000-0ff1-ce00-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "2a01:111:f400:fe5a::100",
  "CorrelationId": "74f816a1-500e-0000-03f9-86a19a6727cf",
  "CreationTime": "2024-03-20T19:33:10",
  "DeviceDisplayName": "2a01:111:2053:70e::ad4:4b49",
  "EventSource": "SharePoint",
  "HighPriorityMediaProcessing": false,
  "Id": "3bc470eb-932d-40d7-91ca-08dc49149360",
  "IsManagedDevice": false,
  "ItemType": "File",
  "ListBaseType": 0,
  "ListId": "92e39b57-9f80-4494-b2da-d041436aa23a",
  "ListItemUniqueId": "aeea621a-9b0d-4be9-b9a7-874014e870b3",
  "ListServerTemplate": 0,
  "ObjectId": "https://attack_range-my.sharepoint.com/personal/attacker_attack_range_lan/Documents/Microsoft Teams Chat Files/Magic8.exe",
  "Operation": "FileMalwareDetected",
  "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae",
  "Platform": "Service",
  "RecordType": 6,
  "Site": "4fcfdc04-9f58-4206-8538-775f5f8da9d9",
  "SiteUrl": "https://attack_range-my.sharepoint.com/personal/attacker_attack_range_lan/",
  "SourceFileExtension": "exe",
  "SourceFileName": "Magic8.exe",
  "SourceRelativeUrl": "Documents/Microsoft Teams Chat Files",
  "UserAgent": "MS Scanner ATP",
  "UserId": "app@sharepoint",
  "UserKey": "i:0i.t|00000003-0000-0ff1-ce00-000000000000|app@sharepoint",
  "UserType": 0,
  "Version": 1,
  "VirusInfo": "Malicious Payload#",
  "VirusVendor": "Advanced Threat Protection",
  "WebId": "84f9cc67-d868-4b28-8a53-ae32a40abae4",
  "Workload": "OneDrive"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 OneDrive Malware File Upload source high: Identifies the occurrence of files uploaded to OneDrive being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries an opportunity to gain initial access to other endpoints in the environment.T1080, T1608, T1608.001
M365 SharePoint Malware File Detected source high: Identifies the occurrence of files uploaded to SharePoint being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunities to gain initial access to other endpoints in the environment.T1080, T1608, T1608.001

Splunk #

O365 SharePoint Malware Detection source: The following analytic identifies when a malicious file is detected within the SharePoint Online ecosystem. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office…T1204, T1204.002

References #

FileModified

RecordType: SharePointFileOperation

Description

File Modified activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "df00e73e-c83f-4ab0-8d19-8bb45f7b11d4",
    "PFTTokenAppId": "22222222-2222-2222-2222-222222222222",
    "TokenIssuedAtTime": "2026-07-02T02:09:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA",
    "UserObjectId": "11111111-1111-1111-1111-111111111111"
  },
  "ApplicationDisplayName": "dw-activity-gen",
  "ApplicationId": "22222222-2222-2222-2222-222222222222",
  "AssertingApplicationId": "00000003-0000-0000-c000-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "203.0.113.10",
  "CorrelationId": "df00e73e-c83f-4ab0-8d19-8bb45f7b11d4",
  "CreationTime": "2026-07-02T02:09:56Z",
  "DeviceDisplayName": "203.0.113.10",
  "EventSource": "SharePoint",
  "FileSizeBytes": 48,
  "GeoLocation": "NAM",
  "HighPriorityMediaProcessing": false,
  "Id": "44ac8673-bf8a-4478-4587-08ded7df0330",
  "IsManagedDevice": false,
  "ItemType": "File",
  "ListBaseType": 1,
  "ListId": "1dd286ec-ffd7-4ecb-8d4b-625786043095",
  "ListItemUniqueId": "fabd0d73-6265-4e9f-a6e5-23d38fd15a0d",
  "ListServerTemplate": 700,
  "ObjectId": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/Documents/dw-harness-60974bd7-test.txt",
  "Operation": "FileModified",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "Platform": "NotSpecified",
  "RecordType": 6,
  "Site": "8b6f4363-9829-4b0a-857a-bced36c2bb38",
  "SiteUrl": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/",
  "SourceFileExtension": "txt",
  "SourceFileName": "dw-harness-60974bd7-test.txt",
  "SourceRelativeUrl": "Documents",
  "UserAgent": "python-requests/2.34.2",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "i:0h.f|membership|10000000aaaaaaaa@live.com",
  "UserType": 0,
  "Version": 1,
  "WebId": "daa58cd7-9a4c-49aa-80a8-891bb23ee9a4",
  "Workload": "OneDrive"
}

References #

FileMoved

RecordType: SharePointFileOperation

Description

File Moved activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "72ae0a1a-4cde-4c36-b38b-a4569385eb3c",
    "PFTTokenAppId": "22222222-2222-2222-2222-222222222222",
    "TokenIssuedAtTime": "2026-07-02T02:09:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA",
    "UserObjectId": "11111111-1111-1111-1111-111111111111"
  },
  "ApplicationDisplayName": "dw-activity-gen",
  "ApplicationId": "22222222-2222-2222-2222-222222222222",
  "AssertingApplicationId": "00000003-0000-0000-c000-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "203.0.113.10",
  "CorrelationId": "72ae0a1a-4cde-4c36-b38b-a4569385eb3c",
  "CreationTime": "2026-07-02T02:09:59Z",
  "DestinationFileExtension": "txt",
  "DestinationFileName": "dw-harness-60974bd7-moved.txt",
  "DestinationRelativeUrl": "Documents",
  "DeviceDisplayName": "203.0.113.10",
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "HighPriorityMediaProcessing": false,
  "Id": "a2edd265-81fb-44ff-645b-08ded7df0532",
  "IsManagedDevice": false,
  "ItemType": "File",
  "ListBaseType": 1,
  "ListId": "1dd286ec-ffd7-4ecb-8d4b-625786043095",
  "ListItemUniqueId": "7b3df71a-ecf4-4a27-b0a4-127d0669c83a",
  "ListServerTemplate": 700,
  "ObjectId": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/Documents/dw-harness-60974bd7-folder/dw-60974bd7-inner.txt",
  "Operation": "FileMoved",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "Platform": "NotSpecified",
  "RecordType": 6,
  "Site": "8b6f4363-9829-4b0a-857a-bced36c2bb38",
  "SiteUrl": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/",
  "SourceFileExtension": "txt",
  "SourceFileName": "dw-60974bd7-inner.txt",
  "SourceRelativeUrl": "Documents/dw-harness-60974bd7-folder",
  "UserAgent": "python-requests/2.34.2",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "i:0h.f|membership|10000000aaaaaaaa@live.com",
  "UserType": 0,
  "Version": 1,
  "WebId": "daa58cd7-9a4c-49aa-80a8-891bb23ee9a4",
  "Workload": "OneDrive"
}

References #

FileRecycled

RecordType: SharePointFileOperation

Description

File Recycled activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "f097b9c1-7b8c-4175-ba98-66c5b789ee4a",
    "PFTTokenAppId": "22222222-2222-2222-2222-222222222222",
    "TokenIssuedAtTime": "2026-07-02T02:09:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA",
    "UserObjectId": "11111111-1111-1111-1111-111111111111"
  },
  "ApplicationDisplayName": "dw-activity-gen",
  "ApplicationId": "22222222-2222-2222-2222-222222222222",
  "AssertingApplicationId": "00000003-0000-0000-c000-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "203.0.113.10",
  "CorrelationId": "f097b9c1-7b8c-4175-ba98-66c5b789ee4a",
  "CreationTime": "2026-07-02T02:10:02Z",
  "DeviceDisplayName": "203.0.113.10",
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "HighPriorityMediaProcessing": false,
  "Id": "0955e636-65d3-4bd6-e206-08ded7df06a2",
  "IsManagedDevice": false,
  "ItemType": "File",
  "ListBaseType": 1,
  "ListId": "a1d0a352-21ad-4dc2-bceb-7c1b1c68a5b9",
  "ListItemUniqueId": "aa501663-7c47-483d-a4ee-8aabb526b9ad",
  "ListServerTemplate": 101,
  "ObjectId": "https://example.sharepoint.com/Shared Documents/dw-harness-60974bd7.txt",
  "Operation": "FileRecycled",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "Platform": "NotSpecified",
  "RecordType": 6,
  "Site": "f0e749d8-c701-41f9-b050-5f3102208aad",
  "SiteUrl": "https://example.sharepoint.com/",
  "SourceFileExtension": "txt",
  "SourceFileName": "dw-harness-60974bd7.txt",
  "SourceRelativeUrl": "Shared Documents",
  "UserAgent": "python-requests/2.34.2",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "i:0h.f|membership|10000000aaaaaaaa@live.com",
  "UserType": 0,
  "Version": 1,
  "WebId": "b3b533bb-81fc-464a-a7d5-033030f4fbcf",
  "Workload": "SharePoint"
}

References #

FileRenamed

RecordType: SharePointFileOperation

Description

File Renamed activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "72ae0a1a-4cde-4c36-b38b-a4569385eb3c",
    "PFTTokenAppId": "22222222-2222-2222-2222-222222222222",
    "TokenIssuedAtTime": "2026-07-02T02:09:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA",
    "UserObjectId": "11111111-1111-1111-1111-111111111111"
  },
  "ApplicationDisplayName": "dw-activity-gen",
  "ApplicationId": "22222222-2222-2222-2222-222222222222",
  "AssertingApplicationId": "00000003-0000-0000-c000-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "203.0.113.10",
  "CorrelationId": "72ae0a1a-4cde-4c36-b38b-a4569385eb3c",
  "CreationTime": "2026-07-02T02:09:59Z",
  "DestinationFileExtension": "txt",
  "DestinationFileName": "dw-harness-60974bd7-moved.txt",
  "DestinationRelativeUrl": "Documents",
  "DeviceDisplayName": "203.0.113.10",
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "HighPriorityMediaProcessing": false,
  "Id": "20490336-79ec-45ff-0144-08ded7df0533",
  "IsManagedDevice": false,
  "ItemType": "File",
  "ListBaseType": 1,
  "ListId": "1dd286ec-ffd7-4ecb-8d4b-625786043095",
  "ListItemUniqueId": "7b3df71a-ecf4-4a27-b0a4-127d0669c83a",
  "ListServerTemplate": 700,
  "ObjectId": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/Documents/dw-harness-60974bd7-folder/dw-60974bd7-inner.txt",
  "Operation": "FileRenamed",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "Platform": "NotSpecified",
  "RecordType": 6,
  "Site": "8b6f4363-9829-4b0a-857a-bced36c2bb38",
  "SiteUrl": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/",
  "SourceFileExtension": "txt",
  "SourceFileName": "dw-60974bd7-inner.txt",
  "SourceRelativeUrl": "Documents/dw-harness-60974bd7-folder",
  "UserAgent": "python-requests/2.34.2",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "i:0h.f|membership|10000000aaaaaaaa@live.com",
  "UserType": 0,
  "Version": 1,
  "WebId": "daa58cd7-9a4c-49aa-80a8-891bb23ee9a4",
  "Workload": "OneDrive"
}

References #

FileSyncDownloadedFull

RecordType: SharePointFileOperation

Description

A user established a sync relationship and successfully downloaded all files from a SharePoint Online / OneDrive document library to a computer (the "Microsoft SkyDriveSync" client). A SharePointFileOperation (RecordType 6) event, alongside the documented FileDownloaded / FileAccessed / FileUploaded operations. A primary bulk-exfiltration-via-sync signal.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`EventSource`	2 detection rules	Kusto
`Operation`	2 detection rules	Kusto
`Workload`	2 detection rules	Kusto

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "782c415a-5fb5-4de5-a365-81c6b6a3e677",
    "ClientAppName": "OneDriveSync",
    "CorrelationId": "93327aa1-4084-0000-6bd5-636d55caff1f",
    "TokenIssuedAtTime": "2025-01-24T19:41:15",
    "UniqueTokenId": "qEHLD19rgU2NrFiaJ1V_AA"
  },
  "CreationTime": "2025-01-23T02:27:26",
  "Id": "ce8754c9-9d81-4b6b-5c57-08dd3b557a3b",
  "Operation": "FileSyncDownloadedFull",
  "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae",
  "RecordType": 6,
  "UserKey": "i:0h.f|membership|30012000b0ea249f@live.com",
  "UserType": 0,
  "Version": 1,
  "Workload": "SharePoint",
  "ClientIP": "214.133.161.103",
  "UserId": "attacker3@attack_range.lan",
  "AuthenticationType": "FormsCookieAuth",
  "CorrelationId": "93327aa1-4084-0000-6bd5-636d55caff1f",
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "IsManagedDevice": true,
  "ItemType": "File",
  "ListId": "8e23817c-d27f-4842-8de0-d52eaf1e0b64",
  "ListItemUniqueId": "7ce49ab6-4c4e-4cfd-aa9f-21eb03c9fc0c",
  "Platform": "WinDesktop",
  "Site": "6886501c-ee68-487c-95f5-b1cb455829ac",
  "UserAgent": "Microsoft SkyDriveSync 24.244.1204.0003 ship; Windows NT 10.0 (19045)",
  "WebId": "63f8ec62-452d-4c83-9524-47d7ac7761a8",
  "DeviceDisplayName": "189.135.168.197",
  "EventSignature": "1.CAESFkZpbGVTeW5jRG93bmxvYWRlZEZ1bGwYjtLGvAYiEDEwMDMyMDAwYjBlYTI0OWYyEgkcUIZoaO58SBGV9bHLRVgprDoSCWLs-GMtRYNMEZUkR9esd2GoQhIJfIEjjn_SQkgRjeDVLq8eC2RKEgm2muR8Tkz9TBGqnyHrA8n8DA.6ZSd3Kpen4vAwh_RziJiDuagh6rOhvSKB8Tn6zdo3Dc",
  "MachineDomainInfo": "931983eb-69c8-4d22-bc19-87c24fb24818",
  "MachineId": "aef98cf7-fb02-4783-8604-15ee388c329b",
  "FileSyncBytesCommitted": "818198",
  "HighPriorityMediaProcessing": false,
  "ListBaseType": 1,
  "ListServerTemplate": 101,
  "SourceFileExtension": "xlsx",
  "SiteUrl": "https://attack_range.sharepoint.com/sites/CorporateSecretsManagement/",
  "SourceRelativeUrl": "Shared Documents/General/ProprietaryInfo",
  "SourceFileName": "ProductionFormula_0.xlsx",
  "ApplicationDisplayName": "OneDriveSync",
  "ObjectId": "https://attack_range.sharepoint.com/sites/CorporateSecretsManagement/Shared Documents/General/ProprietaryInfo/ProductionFormula_0.xlsx"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Office365 Sharepoint File transfer above threshold source medium: Identifies Office365 Sharepoint File Transfers above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.T1020↳ also matches FileDownloaded, FileSyncUploadedFull, FileUploaded
Office365 Sharepoint File transfer Folders above threshold source medium: Identifies Office365 Sharepoint File Transfers with distinct folder count above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.T1020↳ also matches FileDownloaded, FileSyncUploadedFull, FileUploaded

References #

FileSyncDownloadedPartial

RecordType: SharePointFileOperation

Description

A user established a sync relationship and downloaded part of a SharePoint Online / OneDrive document library to a computer (the "Microsoft SkyDriveSync" client). A SharePointFileOperation (RecordType 6) event, the partial-download complement of FileSyncDownloadedFull.

References #

FileSyncUploadedFull

RecordType: SharePointFileOperation

Description

A file was uploaded to SharePoint or OneDrive by the OneDrive sync app (full upload).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`EventSource`	2 detection rules	Kusto
`Operation`	2 detection rules	Kusto
`Workload`	2 detection rules	Kusto

Example Audit Record #

{
  "CreationTime": "2019-11-26T21:48:26",
  "Id": "*REDACTED*",
  "Operation": "FileSyncUploadedFull",
  "OrganizationId": "*REDACTED*",
  "RecordType": 6,
  "UserKey": "*REDACTED*",
  "UserType": 0,
  "Version": 1,
  "Workload": "OneDrive",
  "ClientIP": "*REDACTED*",
  "ObjectId": "*REDACTED*",
  "UserId": "*REDACTED*",
  "CorrelationId": "*REDACTED*",
  "EventSource": "SharePoint",
  "ItemType": "File",
  "ListId": "*REDACTED*",
  "ListItemUniqueId": "*REDACTED*",
  "Site": "*REDACTED*",
  "UserAgent": "*REDACTED*",
  "WebId": "*REDACTED*",
  "MachineDomainInfo": "*REDACTED*",
  "MachineId": "*REDACTED*",
  "FileSyncBytesCommitted": "863",
  "ImplicitShare": "No",
  "SourceFileExtension": "txt",
  "SiteUrl": "*REDACTED*",
  "SourceFileName": "*REDACTED*",
  "SourceRelativeUrl": "*REDACTED*"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

Office365 Sharepoint File transfer above threshold source medium: Identifies Office365 Sharepoint File Transfers above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.T1020↳ also matches FileDownloaded, FileSyncDownloadedFull, FileUploaded
Office365 Sharepoint File transfer Folders above threshold source medium: Identifies Office365 Sharepoint File Transfers with distinct folder count above certain threshold in a 15min time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur.T1020↳ also matches FileDownloaded, FileSyncDownloadedFull, FileUploaded

References #

FileUploaded

RecordType: SharePointFileOperation

Description

A file was uploaded to SharePoint Online or OneDrive.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	7 detection rules	Kusto
`RecordType`	3 detection rules	Kusto
`Workload`	3 detection rules	Kusto
`EventSource`	2 detection rules	Kusto
`SourceFileExtension`	2 detection rules	Kusto
`UserAgent`	2 detection rules	Kusto
`FileAccessCount`	1 detection rule	Kusto
`SourceRelativeUrl`	1 detection rule	Kusto

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "69bff3c0-ac53-49ac-967c-8c90523b7537",
    "PFTTokenAppId": "22222222-2222-2222-2222-222222222222",
    "TokenIssuedAtTime": "2026-07-02T02:04:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA",
    "UserObjectId": "11111111-1111-1111-1111-111111111111"
  },
  "ApplicationDisplayName": "dw-activity-gen",
  "ApplicationId": "22222222-2222-2222-2222-222222222222",
  "AssertingApplicationId": "00000003-0000-0000-c000-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "203.0.113.10",
  "CorrelationId": "69bff3c0-ac53-49ac-967c-8c90523b7537",
  "CreationTime": "2026-07-02T02:09:59Z",
  "DeviceDisplayName": "203.0.113.10",
  "EventSignature": "1.CAESDEZpbGVVcGxvYWRlZBj3kJfSBiIQMTAwMzIwMDU3ZjRjMTg3OSokM2MxYTgxMDctMGI3ZS00MzFkLTg3OGYtZWJmNDg4NDgyYWUzMhIJY0NviymYCksRhXq87TbCuzg6EgnXjKXaTJqqSRGAqIkbsj7ppEISCeyG0h3X_8tOEY1LYleGBDCVShIJGvc9e_TsJ0oRsKQSfQZpyDo.3kCeDT1RoH0qchDsvPcFY4Wi4govl2Nk9cAKEgljnvE",
  "EventSource": "SharePoint",
  "FileSizeBytes": 10,
  "GeoLocation": "NAM",
  "HighPriorityMediaProcessing": false,
  "Id": "5db36de1-c155-4ec6-da97-08ded7df04fb",
  "ImplicitShare": "No",
  "IsManagedDevice": false,
  "ItemType": "File",
  "ListBaseType": 1,
  "ListId": "1dd286ec-ffd7-4ecb-8d4b-625786043095",
  "ListItemUniqueId": "7b3df71a-ecf4-4a27-b0a4-127d0669c83a",
  "ListServerTemplate": 700,
  "ObjectId": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/Documents/dw-harness-60974bd7-folder/dw-60974bd7-inner.txt",
  "Operation": "FileUploaded",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "Platform": "NotSpecified",
  "RecordType": 6,
  "Site": "8b6f4363-9829-4b0a-857a-bced36c2bb38",
  "SiteUrl": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/",
  "SourceFileExtension": "txt",
  "SourceFileName": "dw-60974bd7-inner.txt",
  "SourceRelativeUrl": "Documents/dw-harness-60974bd7-folder",
  "UserAgent": "python-requests/2.34.2",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "i:0h.f|membership|10000000aaaaaaaa@live.com",
  "UserType": 0,
  "Version": 1,
  "WebId": "daa58cd7-9a4c-49aa-80a8-891bb23ee9a4",
  "Workload": "OneDrive"
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`Deviation` (kusto rule field)	gt	`25`	2 rules	kusto
`TimeDeleted` (kusto rule field)	cross_field_compare	`TimeAdded`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

New executable via Office FileUploaded Operation source low: Identifies when executable file types are uploaded to Office services such as SharePoint and OneDrive. List currently includes 'exe', 'inf', 'gzip', 'cmd', 'bat' file extensions. Additionally, identifies when a given user is uploading these files to another users workspace. This may be indication of a staging location for malware or other malicious activity.T1105, T1570
Dataverse - Executable uploaded to SharePoint document management site source low: Identifies executable files and scripts uploaded to SharePoint sites used for Dynamics document management, circumventing native file extension restrictions in Dataverse.T0863, T0873
Accessed files shared by temporary external user source low: This detection identifies when an external user is added to a Team or Teams chat and shares a file which is accessed by many users (>10) and the users is removed within short period of time. This might be an indicator of suspicious activity.T1566↳ also matches FileAccessed

Show 4 more (7 total) on the rules page

References #

FileVersionsAllDeleted

RecordType: SharePointFileOperation

Description

All versions of a file were deleted from a SharePoint Online or OneDrive site.

References #

FolderCreated

RecordType: SharePointFileOperation

Description

Folder Created activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "0b12737c-519a-43b2-bf54-035134b8f017",
    "PFTTokenAppId": "22222222-2222-2222-2222-222222222222",
    "TokenIssuedAtTime": "2026-07-02T02:09:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA",
    "UserObjectId": "11111111-1111-1111-1111-111111111111"
  },
  "ApplicationDisplayName": "dw-activity-gen",
  "ApplicationId": "22222222-2222-2222-2222-222222222222",
  "AssertingApplicationId": "00000003-0000-0000-c000-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "203.0.113.10",
  "CorrelationId": "0b12737c-519a-43b2-bf54-035134b8f017",
  "CreationTime": "2026-07-02T02:09:58Z",
  "DeviceDisplayName": "203.0.113.10",
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "HighPriorityMediaProcessing": false,
  "Id": "eaf591f1-f0da-4e42-98fe-08ded7df0482",
  "IsManagedDevice": false,
  "ItemType": "Folder",
  "ListBaseType": 1,
  "ListId": "1dd286ec-ffd7-4ecb-8d4b-625786043095",
  "ListItemUniqueId": "e8a6970b-7b61-40e0-b19f-6e63affb28a8",
  "ListServerTemplate": 700,
  "ObjectId": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/Documents/dw-harness-60974bd7-folder",
  "Operation": "FolderCreated",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "Platform": "NotSpecified",
  "RecordType": 6,
  "Site": "8b6f4363-9829-4b0a-857a-bced36c2bb38",
  "SiteUrl": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/",
  "SourceFileName": "dw-harness-60974bd7-folder",
  "SourceRelativeUrl": "Documents",
  "UserAgent": "python-requests/2.34.2",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "i:0h.f|membership|10000000aaaaaaaa@live.com",
  "UserType": 0,
  "Version": 1,
  "WebId": "daa58cd7-9a4c-49aa-80a8-891bb23ee9a4",
  "Workload": "OneDrive"
}

References #

FolderDeleted

RecordType: SharePointFileOperation

Description

A folder was deleted from a SharePoint Online or OneDrive site.

Example Audit Record #

{
  "CreationTime": "2019-11-26T21:30:24",
  "Id": "*REDACTED*",
  "Operation": "FolderDeleted",
  "OrganizationId": "*REDACTED*",
  "RecordType": 6,
  "UserKey": "*REDACTED*",
  "UserType": 0,
  "Version": 1,
  "Workload": "OneDrive",
  "ClientIP": "*REDACTED*",
  "ObjectId": "*REDACTED*",
  "UserId": "*REDACTED*",
  "CorrelationId": "*REDACTED*",
  "EventSource": "SharePoint",
  "ItemType": "Folder",
  "ListId": "*REDACTED*",
  "ListItemUniqueId": "*REDACTED*",
  "Site": "*REDACTED*",
  "UserAgent": "*REDACTED*",
  "WebId": "*REDACTED*",
  "SiteUrl": "*REDACTED*",
  "SourceFileName": "*REDACTED*",
  "SourceRelativeUrl": "*REDACTED*"
}

References #

FolderModified

RecordType: SharePointFileOperation

Description

Folder Modified activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "0b12737c-519a-43b2-bf54-035134b8f017",
    "PFTTokenAppId": "22222222-2222-2222-2222-222222222222",
    "TokenIssuedAtTime": "2026-07-02T02:09:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA",
    "UserObjectId": "11111111-1111-1111-1111-111111111111"
  },
  "ApplicationDisplayName": "dw-activity-gen",
  "ApplicationId": "22222222-2222-2222-2222-222222222222",
  "AssertingApplicationId": "00000003-0000-0000-c000-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "203.0.113.10",
  "CorrelationId": "0b12737c-519a-43b2-bf54-035134b8f017",
  "CreationTime": "2026-07-02T02:09:58Z",
  "DeviceDisplayName": "203.0.113.10",
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "HighPriorityMediaProcessing": false,
  "Id": "0433ce9b-8fff-4d95-fe7f-08ded7df04a4",
  "IsManagedDevice": false,
  "ItemType": "Folder",
  "ListBaseType": 1,
  "ListId": "1dd286ec-ffd7-4ecb-8d4b-625786043095",
  "ListItemUniqueId": "e8a6970b-7b61-40e0-b19f-6e63affb28a8",
  "ListServerTemplate": 700,
  "ObjectId": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/Documents/dw-harness-60974bd7-folder",
  "Operation": "FolderModified",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "Platform": "NotSpecified",
  "RecordType": 6,
  "Site": "8b6f4363-9829-4b0a-857a-bced36c2bb38",
  "SiteUrl": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/",
  "SourceFileName": "dw-harness-60974bd7-folder",
  "SourceRelativeUrl": "Documents",
  "UserAgent": "python-requests/2.34.2",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "i:0h.f|membership|10000000aaaaaaaa@live.com",
  "UserType": 0,
  "Version": 1,
  "WebId": "daa58cd7-9a4c-49aa-80a8-891bb23ee9a4",
  "Workload": "OneDrive"
}

References #

FolderRecycled

RecordType: SharePointFileOperation

Description

Folder Recycled activity in SharePoint / OneDrive file, recorded in the Unified Audit Log (observed in first-party capture).

Example Audit Record #

{
  "AppAccessContext": {
    "AADSessionId": "0022840a-e4ab-884c-587f-d20d24637227",
    "APIId": "00000003-0000-0000-c000-000000000000",
    "ClientAppId": "22222222-2222-2222-2222-222222222222",
    "ClientAppName": "dw-activity-gen",
    "CorrelationId": "f41bd682-8e98-44fd-ba23-373000a0aef6",
    "PFTTokenAppId": "22222222-2222-2222-2222-222222222222",
    "TokenIssuedAtTime": "2026-07-02T02:09:44Z",
    "UniqueTokenId": "fok73fVNMECa2s8q2X5cAA",
    "UserObjectId": "11111111-1111-1111-1111-111111111111"
  },
  "ApplicationDisplayName": "dw-activity-gen",
  "ApplicationId": "22222222-2222-2222-2222-222222222222",
  "AssertingApplicationId": "00000003-0000-0000-c000-000000000000",
  "AuthenticationType": "OAuth",
  "ClientIP": "203.0.113.10",
  "CorrelationId": "f41bd682-8e98-44fd-ba23-373000a0aef6",
  "CreationTime": "2026-07-02T02:10:00Z",
  "DeviceDisplayName": "203.0.113.10",
  "EventSource": "SharePoint",
  "GeoLocation": "NAM",
  "HighPriorityMediaProcessing": false,
  "Id": "a2c43183-ccf1-4115-309d-08ded7df058d",
  "IsManagedDevice": false,
  "ItemType": "Folder",
  "ListBaseType": 0,
  "ListId": "1dd286ec-ffd7-4ecb-8d4b-625786043095",
  "ListItemUniqueId": "e8a6970b-7b61-40e0-b19f-6e63affb28a8",
  "ListServerTemplate": 0,
  "ObjectId": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/Documents/dw-harness-60974bd7-folder",
  "Operation": "FolderRecycled",
  "OrganizationId": "00000000-0000-0000-0000-000000000001",
  "Platform": "NotSpecified",
  "RecordType": 6,
  "Site": "8b6f4363-9829-4b0a-857a-bced36c2bb38",
  "SiteUrl": "https://example-my.sharepoint.com/personal/adminuser_example_onmicrosoft_com/",
  "SourceFileName": "dw-harness-60974bd7-folder",
  "SourceRelativeUrl": "Documents",
  "UserAgent": "python-requests/2.34.2",
  "UserId": "adminuser@example.onmicrosoft.com",
  "UserKey": "i:0h.f|membership|10000000aaaaaaaa@live.com",
  "UserType": 0,
  "Version": 1,
  "WebId": "daa58cd7-9a4c-49aa-80a8-891bb23ee9a4",
  "Workload": "OneDrive"
}

References #

SearchQueryPerformed

RecordType: SharePointFileOperation

Description

A user or system account performed a search in SharePoint or OneDrive (listed under SharePoint file and page activities).

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`Operation`	2 detection rules	Splunk
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic
`EventData`	1 detection rule	Splunk
`o365.audit.SearchQueryText`	1 detection rule	Elastic
`SearchQueryText`	1 detection rule	Splunk
`Workload`	1 detection rule	Splunk

Common Indicators #

Field	Kind	Value	Rules	Vendors
`EventData` (splunk rule field)	contains	`search`	1 rule	splunk
`SearchQueryText` (splunk rule field)	eq	`*`	1 rule	splunk
`event.outcome` (elastic rule field)	eq	`success`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`1099`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`access key`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`account number`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`acquisition`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`admin`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`api key`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`apikey`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`architecture`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`attorney`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`aws`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`azure`	1 rule	elastic
`o365.audit.SearchQueryText` (elastic rule field)	contains	`background check`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 SharePoint Search for Sensitive Content source low: Identifies search queries in SharePoint containing sensitive terms related to credentials, financial data, PII, legal matters, or infrastructure information. Adversaries who compromise user accounts often search for high-value files before exfiltration. This rule detects searches containing terms across multiple sensitivity categories, regardless of the access method (browser, PowerShell, or API). The actual search query text is analyzed against a curated list of sensitive terms to identify potential reconnaissance activity.T1213, T1213.002, T1530, T1619

Splunk #

O365 SharePoint Suspicious Search Behavior source: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a SharePoint site within a limited timeframe. This behavior may indicate that a malicious actor has gained…T1213, T1213.002, T1552
O365 Email Suspicious Search Behavior source: The following analytic identifies when Office 365 users search for suspicious keywords or have an excessive number of queries to a mailbox within a limited timeframe. This behavior may indicate that a malicious actor has gained control of…T1114, T1114.002, T1552

References #

M365 audit records use different field names on each surface #

The same Unified Audit Log record uses different field names on each surface. A query built for one surface can silently miss on another. These pages document the Management Activity API JSON names, the same names Search-UnifiedAuditLog and the Office 365 Management Activity API return.

Purview CSV export flattens each record to four columns (CreationDate, UserIds, Operations, AuditData). The API field names live only inside the AuditData JSON blob. Expand it with ConvertFrom-Json. The wrapper columns are renamed too: CreationDate not CreationTime, UserIds not UserId, Operations not Operation.
Sentinel's OfficeActivity table renames several fields and turns two integer enum columns into strings. The table below maps them.

API JSON (event pages)	OfficeActivity column	Note
`Id`	`OfficeId`	Renamed.
`Workload`	`OfficeWorkload`	Renamed.
`ObjectId`	`OfficeObjectId`	Renamed.
`CreationTime`	`TimeGenerated`	Renamed. OfficeActivity has no `CreationTime` column.
`SiteUrl`	`Site_Url`	Renamed (SharePoint family).
`RecordType`	`RecordType`	Same name; the Int32 enum becomes its string enum name.
`UserType`	`UserType`	Same name; the Int32 enum becomes a string.
`ClientIP`	`ClientIP`, `Client_IPAddress`	Both columns present on OfficeActivity.
`Scope`	(none)	No OfficeActivity equivalent under any name. Recover it from the API JSON or the Purview `AuditData` blob.
`Operation`, `UserId`, `ResultStatus`, `UserKey`, `AppAccessContext`, `OrganizationId`	same names	Unchanged. No `_s` / `_d` suffixes (a native table, not a custom log).

Mapping verified against the OfficeActivity table reference, the Management Activity API schema, and the Purview audit-record export format.

SharePoint file operations

any: SharePoint file operations (catch-all)

Description

Detection Fields #

Common Indicators #

Detection Rules #

Splunk #

References #

FileAccessed

Description

Detection Fields #

Example Audit Record #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Kusto #

YARA-L #

References #

FileDeleted

Description

Example Audit Record #

References #

FileDownloaded

Description

Detection Fields #

Example Audit Record #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Kusto #

YARA-L #

References #

FileMalwareDetected

Description

Detection Fields #

Example Audit Record #

Detection Rules #

Elastic #

Splunk #

References #

FileModified

Description

Example Audit Record #

References #

FileMoved

Description

Example Audit Record #

References #

FileRecycled

Description

Example Audit Record #

References #

FileRenamed

Description

Example Audit Record #

References #

FileSyncDownloadedFull

Description

Detection Fields #

Example Audit Record #

Related events #

Detection Rules #

Kusto #

References #

FileSyncDownloadedPartial

Description

References #

FileSyncUploadedFull

Description

Detection Fields #

Example Audit Record #

Related events #

Detection Rules #

Kusto #

References #

FileUploaded