Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload
Flags successful Microsoft Cloud App Security reports of potential ransomware-related file uploads in Microsoft 365.
- Product
- m365
- Service
- threat_management
- Author
- austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-19
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies events where Microsoft Cloud App Security reports “Potential ransomware activity” with a successful status. Such alerts matter because attackers may upload files that appear ransomware-infected to propagate malware or trigger downstream compromise. The detection relies on SecurityComplianceCenter threat management telemetry containing the event source, event name, and success status.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Microsoft 365 Cloud App Security - Potential Ransomware Activity Alerts on File Upload
id: 7efbb41d-8973-4fc5-9ffc-2650d3d9502e
status: test
description: This rule identifies events where Microsoft Cloud App Security reports “Potential ransomware activity” with a successful status. Such alerts matter because attackers may upload files that appear ransomware-infected to propagate malware or trigger downstream compromise. The detection relies on SecurityComplianceCenter threat management telemetry containing the event source, event name, and success status.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml
author: austinsonger, Huntrule Team
date: 2021-08-19
modified: 2022-10-09
tags:
- attack.impact
- attack.t1486
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Potential ransomware activity
status: success
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: bd132164-884a-48f1-aa2d-c6d646b04c69
type: derived