Microsoft 365 Cloud App Security Reports Potential Ransomware Uploads
Flags successful Microsoft Cloud App Security reports of potential ransomware-related file uploads in Microsoft 365.
FreeUnreviewedSigmamediumv1
microsoft-365-cloud-app-security-reports-potential-ransomware-uploads-bd132164
title: Microsoft 365 Cloud App Security Reports Potential Ransomware Uploads
id: 7efbb41d-8973-4fc5-9ffc-2650d3d9502e
status: test
description: This rule alerts when Microsoft Cloud App Security reports a successful event labeled "Potential ransomware activity" in the SecurityComplianceCenter context. It matters because attackers often stage or exfiltrate encrypted or malicious payloads by uploading files to cloud services. The detection relies on threat management telemetry from Microsoft 365 that includes the event source, event name, and success status.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml
author: austinsonger, Huntrule Team
date: 2021-08-19
modified: 2022-10-09
tags:
- attack.impact
- attack.t1486
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Potential ransomware activity
status: success
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: bd132164-884a-48f1-aa2d-c6d646b04c69
type: derived
What it detects
This rule alerts when Microsoft Cloud App Security reports a successful event labeled "Potential ransomware activity" in the SecurityComplianceCenter context. It matters because attackers often stage or exfiltrate encrypted or malicious payloads by uploading files to cloud services. The detection relies on threat management telemetry from Microsoft 365 that includes the event source, event name, and success status.
Known false positives
- Unknown
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.