General

This alarm is triggered when SharePoint (including OneDrive) detects malware in a file.

Rationale

Employees can upload files to SharePoint and OneDrive from systems that may not have antivirus software, where the antivirus software was not up-to-date, or where the antivirus software did not yet recognize a particular virus. As a result, a file may be uploaded to SharePoint or later downloaded that turns out to contain a virus. It is always advisable to investigate where this virus came from, as it may indicate that a system or user account of an employee has been compromised.

Follow-up

Perform these steps to adequately follow up on this detection:

1. Ask the employee who uploaded the file if this was done intentionally.
   
   1. If not: consider the employee's account as compromised
      1. Reset the employee's password
      2. Revoke all logged-in sessions of the administrator
2. Download the file from SharePoint to secure it for analysis and then delete it from SharePoint.
3. Perform a full system scan with up-to-date antivirus software on the employee's computer from which the file was uploaded. If the system in question does not contain antivirus software, HitmanPro or Malwarebytes can be used.
4. Consider conducting an Attic Tier2 investigation to learn more about the attack (who, what, when, where, why, how?). This is strongly advised if the affected employee has administrative rights.

More Information

1. https://support.microsoft.com/en-au/office/what-to-do-when-a-malicious-file-is-found-in-sharepoint-online-onedrive-or-microsoft-teams-01e902ad-a903-4e0f-b093-1e1ac0c37ad2