huntrule

Suspicious Microsoft 365 File Download with Scripting User Agent and Spoofed Office Client (via m365)

PremiumReviewedSigma · High · v1
Product
m365
Service
sharepoint
Author
HuntRule
Published
2026-10-12
Updated
2026-10-12
AnalysisDetection

ATT&CK techniques

Collection → Exfiltration

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects Microsoft 365 audit file access and download events that carry a python-requests or Windows PowerShell user agent while presenting the client application identifier of Microsoft Office, an anomaly seen in the BlackFile vishing extortion operation where operators used stolen tokens to bulk-pull SharePoint and OneDrive content. Legitimate Office clients do not present scripting user agents, so this mismatch signals programmatic data theft under a spoofed application identity.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange
Suspicious Masqueraded Exfiltration Utility AuditSvc Execution (via process_creation)
Suspicious Cloud Exfiltration via Rclone Linked to INC Ransomware
Suspicious s5cmd Execution for Cloud Storage Exfiltration
Suspicious Data Staging via Everything and 7-Zip Prior to Exfiltration via process_creation
Suspicious Rclone Cloud Exfiltration Execution
Malicious Data Exfiltration via S5cmd to S3
Malicious Data Exfiltration via Backblaze B2 CLI
Malicious Data Exfiltration via Restic Remote Backup
Malicious Data Exfiltration to MEGA via Rclone
Suspicious Microsoft 365 File Download with Scripting User Agent and Spoofed Office Client (via m365)
Pivot detection · T1567.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.