Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

BEC - File sharing tactics - OneDrive or SharePoint

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•4•0•85

This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint

Microsoft Sentinel (KQL)

Tags

T1021 - Remote Services TA0008 - Lateral Movement TA0010 - Exfiltration T1537 - Transfer Data to Cloud Account T1070.004 - File Deletion T1204.002 - Malicious File T1213.002 - Sharepoint T1558.002 - Silver Ticket T1585.003 - Cloud Accounts T1570 - Lateral Tool Transfer T1657 - Financial Theft T1078.004 - Cloud Accounts T1586.003 - Cloud Accounts TA0005 - Defense Evasion TA0002 - Execution TA0009 - Collection TA0006 - Credential Access TA0042 - Resource Development TA0040 - Impact TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access T1566.002 - Spearphishing Link File Share Access Data Exfiltration Email Phishing Detected Office 365 M365 Unified Audit Logkqltactic:LateralMovementtechnique:T1021

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?