File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)

This query lists the top malware families detected in files across SharePoint, OneDrive and Teams by Microsoft Defender for Office 365 (Safe Attachments detonation), using the FileMaliciousContentInfo table.

Detection logic

Detection requirements

Platform: Identity Provider Linux macOS Office Suite SaaS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: microsoftthreatprotection
Log source service: filemaliciouscontentinfo

Detection rules

File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules