huntrule

Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload

Flags successful Microsoft Cloud App Security reports of potential ransomware-related file uploads in Microsoft 365.

FreeReviewedSigma · Medium · v4
Product
m365
Service
threat_management
Author
austinsonger (SigmaHQ), DRL 1.1
Published
2021-08-19
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies events where Microsoft Cloud App Security reports “Potential ransomware activity” with a successful status. Such alerts matter because attackers may upload files that appear ransomware-infected to propagate malware or trigger downstream compromise. The detection relies on SecurityComplianceCenter threat management telemetry containing the event source, event name, and success status.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Possible Azure Storage Ransomware via Customer-Managed Key Encryption
Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)
Suspicious CyberLock Ransomware Encrypted File Creation
Rhysida Ransomware Encrypted File Extension Created
Phobos 8Base Ransomware Encrypted File Extension Created
Rhysida Ransomware Note CriticalBreachDetected.pdf Created
Possible Akira Ransomware Note or Encrypted Extension Creation
Malicious Storm-2603 Ransom Note File Creation
Possible Ransomware Note or Encrypted File Extension Creation
Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload
Pivot detection · T1486 · 9 related

Changelog

v4
  1. v4
    Candidate ingested via manual entry.2026-07-31
  2. v3
    Candidate ingested via manual entry.2026-07-31
  3. v2
    Candidate ingested via manual entry.2026-07-31
  4. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.