Office Activity with Hashed File

nomit vyas@xoxo

•updated Jun 22, 2026•1•0•8

This rule detects any activity within Office 365 logs that includes a 'username' field and then projects a SHA256 hash of a 'file.exe'. While the specific detection logic is incomplete, it indicates an attempt to correlate Office 365 user activity with file execution or manipulation, potentially for forensic analysis or to identify suspicious file interactions.