Malicious File Shared via OneDrive Phishing
This rule detects potential phishing attempts involving malicious file sharing via OneDrive. It specifically looks for HTTP traffic directed to 'onedrive.live.com' with 'sharing' in the URI. A threshold is set to trigger an alert if five such events occur from the same source within 60 seconds, indicating a potential automated or repeated attempt to share malicious content.
Suricata
