Suspicious File Extension Upload To Office 365

let SusFileExtensions = externaldata(Extension: string)[@"https://raw.githubusercontent.com/jkerai1/SoftwareCertificates/refs/heads/main/Bulk-IOC-CSVs/MDA/SuspiciousFileExtensions.txt"] with (format="txt", ignoreFirstRecord=False); OfficeActivity | where TimeGenerated > ago(90d) | where Operation == "FileUploaded" or Operation == "FileDownloaded" | where SourceFileExtension has_any(SusFileExtensions) | summarize count() by SourceFileExtension, SourceFileName

Explanation

This query is designed to analyze OfficeActivity logs to identify potentially suspicious file uploads and downloads based on their file extensions. Here's a simple breakdown of what it does:

Define Suspicious Extensions: It starts by loading a list of suspicious file extensions from an external text file hosted on GitHub.
Filter Office Activities: It looks at Office activities from the last 90 days (TimeGenerated > ago(90d)) and focuses on operations where files were either uploaded or downloaded (Operation == "FileUploaded" or Operation == "FileDownloaded").
Check for Suspicious Extensions: It filters these activities to find files with extensions that match any of those in the suspicious list (SourceFileExtension has_any(SusFileExtensions)).
Summarize Results: Finally, it counts the occurrences of each suspicious file extension and groups the results by the file extension and file name (summarize count() by SourceFileExtension, SourceFileName).

In summary, this query helps identify and count potentially suspicious file transfers based on a predefined list of file extensions.

KQL Search

Suspicious File Extension Upload To Office 365

Query

Explanation

Details

Actions