# SharePoint Online Monitoring (TryHackMe)

## Introduction

SharePoint Online is one of the most targeted M365 services, as it often stores sensitive files and can be used to propagate the attack. This room will explore the most common attack scenarios on SharePoint Online and explain how to monitor for them as a SOC team.

## **Learning Objectives**

*   Learn Entra ID and SharePoint audit log formats
    
*   Explore how attackers exfiltrate data from SharePoint
    
*   Discover how SharePoint can become an attack tool
    
*   Practice the learned topics through an attack scenario
    

## **Prerequisites**

*   [M365 Monitoring Basics](https://tryhackme.com/room/m365monitoringbasics)
    
*   [Entra ID Monitoring](https://tryhackme.com/room/entraidmonitoring)
    

## SharePoint Overview

## **SharePoint Overview**

SharePoint Online is a service within the Microsoft 365 suite that lets you store, organize, share, and access corporate information through a web browser. It is widely used by organizations that use the Microsoft stack to keep team documentation and collaborate on documents, spreadsheets, and presentations. It is basically a business version of Google Drive and Microsoft OneDrive:

*   **Google Drive**: A cloud service to store and collaborate on files through the web
    
*   **Microsoft OneDrive**: Microsoft's analogue of Google Drive, built for personal files
    
*   **Microsoft SharePoint**: A more powerful version of OneDrive for corporate use
    

![SharePoint document library for "TryHackMe Sales" site showing a list of documents including a "Reports-2025" folder and a "Contract Template.docx" Word file, with options to filter, add, and manage documents in the toolbar.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1769701392664.png align="center")

For future reference, SharePoint organizes data into top-level containers called **sites**, where each site is tied to an email group (e.g. **sales@tryhackme.thm**) and contains files, folders, or web pages. Also, note that there is an on-premises version of SharePoint. It is rarely used and relies on Active Directory authentication. This room will only explain SharePoint Online, a cloud-based service.

## **SharePoint and M365**

SharePoint is deeply integrated into the Microsoft 365 suite. For example, authentication to SharePoint is performed via an Entra ID login, so if an adversary breaches a corporate Microsoft account with the right permissions, they automatically get access to all the SharePoint files the victim has access to. Fortunately, you can always audit SharePoint logins in the Entra ID console:

![Entra ID sign-in logs showing filtered results for SharePoint application activity. The table displays user sign-in attempts by Emily Turner with dates, request IDs, application names, status (Success/Interrupted), and IP addresses.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1769701392633.png align="center")

## **SharePoint Risks**

*   IT sites may contain network diagrams, application source code, or even keys
    
*   Finance sites may contain internal reports and confidential documents
    
*   Sales sites typically contain big spreadsheets of partners and customers
    
*   In short, SharePoint is one of the most important M365 services to monitor
    

### Answer the questions below

Which of the mentioned Microsoft services is like SharePoint, but for personal use? `OneDrive`

How do you call the SharePoint top-level container that holds objects, such as files? `Site`

## SharePoint Logging

## **SharePoint Sign-In Logs**

Same as with other M365 services, you need to combine Entra ID and M365 logs to monitor SharePoint properly. Entra ID sign-in logs show authentication attempts to SharePoint, and M365 unified audit logs show file operations: access, modification, and sharing. Let's start with the sign-in logs. Below is a chain of sign-in events you will see during a legitimate SharePoint access of Emily Turner:

![Splunk search results showing Entra ID sign-in logs with 18 events. The table displays timestamps, user principal names for Emily Turner, application names including Office 365 and SharePoint Online, IP addresses, browser details showing Edge, and status error codes.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1769724114560.png align="center")

The first two events from the image indicate that Emily logged in to the M365 home portal ([**m365.cloud.microsoft**](http://m365.cloud.microsoft)). From there, she accessed the corporate SharePoint portal. The last event, login to Office365 Shell WCSS-Client, occurs automatically whenever a user navigates in M365 apps. If you want to monitor SharePoint logins, focus on sign-in events **#3** and **#4**. Also, please remember that logins from IPv6 can still be malicious. Never assume that IPv6 equals False Positive!

## **SharePoint File Operations**

After signing in, Emily will interact with the site. You would see all her activities in M365 audit logs, with the **Workload** field always set to **SharePoint**. Let's see the simplest example, access to the Contract Templates document through SharePoint:

```js
{
  "CreationTime": "2026-01-29T15:08:32",
  "OrganizationId": "755c8cb5-4ddf-4c5e-[...]", // MS365 tenant ID
  "Operation": "FileAccessed",                  // Event name (action)
  "Workload": "SharePoint",                     // Target service
  "UserId": "emily.turner@tryhackme.thm",       // Source user email
  "AuthenticationType": "OAuth",
  "Site": "66c03890-ed18-42b3-[...]",           // SharePoint site ID
  "UserAgent": "MSWAC",                         // Internal SharePoint user-agent
  "ClientIP": "20.54.165.63",                   // IP of M365 server, not Emily's!
  "DeviceDisplayName": "20.54.165.63",          // Again, this is not Emily's IP!
  "SourceRelativeUrl": "Shared Documents",      // Folder of the file
  "SourceFileName": "Contract Template.docx",   // Accessed file name
  "SourceFileExtension": "docx",
  "ApplicationDisplayName": "WebWord",
  "SiteUrl": "https://tryhackme.sharepoint.com/sites/thm-sales/",
  "ObjectId": "https://tryhackme.sharepoint.com/sites/thm-sales/Shared Documents/Contract Template.docx"
}
```

The event below follows a similar M365 log structure, where Workload, Operation, and UserId fields are always present, and other fields depend on the event. Note that you shouldn't blindly trust IPs and user agents in the logs, as they often refer to SharePoint servers rather than the actual clients. Overall, you should focus on the file operations below ([Documentation(opens in new tab)](https://learn.microsoft.com/en-us/purview/audit-log-activities#file-and-page-activities)):

*   `FileCreated`/`FileUploaded`: Useful to track suspicious file uploads
    
*   `FileDeleted`/`FileRecycled`: Essential for audit and compliance purposes
    
*   `FileAccessed`/`FileDownloaded`: Helpful for many types of cyber incidents
    

## **File Sharing in SharePoint**

Another important monitoring aspect is file sharing. Microsoft reports both when sharing settings were changed and whenever a sharing link was used. That's great since file sharing can be abused in various scenarios that you will learn in the next tasks. Let's assume Emily shared a sensitive file with an external, untrusted email. You can start the hunt as:

| **List SharePoint sharing events (Splunk)** |
| --- |
|  |

```c
index=* Workload=SharePoint Operation IN(AddedToSecureLink, AnonymousLinkCreated)
```

If there is a match, you will see which file was shared (**ObjectId**) and with whom (**TargetUserOrGroupName**). Note that it's only valid for external sharing. For internal sharing, better hunt for the **SharingSet** events and refer to the [documentation(opens in new tab)](https://learn.microsoft.com/en-us/purview/audit-log-sharing#sharing-auditing-work-flow) for technical details. Next, you might want to check if the target user has already accessed the link, or if you have time to revoke the sharing before it's too late:

| **List SharePoint sharing events (Splunk)** |
| --- |
|  |

```c
index=* Workload=SharePoint Operation IN(SecureLinkUsed, AnonymousLinkUsed)
```

In Splunk, you can analyze both events in a single timeline. Below is an example showing how Emily shared a sensitive file with an external user (**AddedToSecureLink**), and how the user accessed the file a minute later (**SecureLinkUsed**). In most cases, these events are also followed by a **FileAccessed** event.

![Splunk search results showing M365 SharePoint operations with 2 events. The table displays timestamps, operations (AddedToSecureLink and SecureLinkUsed), user IDs for Emily Turner and a guest user from "ShadyCorp", and object IDs containing SharePoint URLs for shared Excel documents.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1769732892984.png align="center")

**Practice**  
For this task, open the [Splunk console(opens in new tab)](https://lab_web_url.p.thmlabs.com/) in your web browser.  
You will need both data sources from the `index=practice` query.  
Search for **All Time** and investigate the activity of Emily Turner.

### Answer the questions below

Refer to the Entra ID sign-in logs (**azure:aad:signin**).  
What is the event ID that confirms Emily's login to SharePoint?

```shell
index=practice user="emily.turner@tryhackme.thm" action=success login
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/61db4ceb-9922-4b9a-87e8-fe31768993df.png align="center")

Move on to the SharePoint logs (**o365:management:activity**).  
What PDF file did Emily upload to the SharePoint?

```shell
index=practice pdf user="emily.turner@tryhackme.thm"
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/3f9f4b72-071f-4a75-89ca-bd542b37b6ff.png align="center")

Soon after, Emily shared the PDF with an external user.  
What is the email of the target user?

```shell
index=practice instructions.pdf action=shared
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/67afd1da-fdae-45f7-80ee-8653c1154b3e.png align="center")

## Detecting Data Exfiltration

## **SharePoint Data Access**

SharePoint is one of the primary targets for threat actors. After an account is compromised, the adversary may explore the contents of their SharePoint and exfiltrate files of interest, such as contracts, reports, internal wiki pages, or source code. Depending on the type and size of data, the adversary may:

*   Open the file in the browser and read it without downloading. Generates the **FileAccessed** event for every file.
    
*   Download the needed file or folder. Generates a **FileDownloaded** or similar event for every downloaded file.
    
*   Share the file with anyone and access it anonymously via a link. Still generates share events and **FileAccessed**.
    

## **Data Exfiltration via GUI**

The simplest way to view SharePoint data is through the M365 portal. Like legitimate users, attackers can browse folders, open files, and download sensitive data. Unfortunately, if attackers act cautiously, their activity is hard to distinguish from normal SharePoint usage. Still, you can alert on a spike in **FileDownloaded** events, since downloading a folder generates one event per file inside. The search below shows how a single **Reports-2025** folder download resulted in five events:

![Splunk search results showing M365 SharePoint file download statistics with 5 events. The table displays site URL, source relative URL for a shared documents folder, user ID for Emily Turner, download count of 5, and a list of downloaded files including Word documents, Excel, and PowerPoint files.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1770117223197.png align="center")

## **Data Exfiltration via App**

The M365 portal does not allow full site export and does not support advanced search. Therefore, if attackers want to dump gigabytes of data, they must resort to external tools. Examples include the OneDrive app, the Rclone CLI utility, and many more paid solutions that allow you to sync SharePoint content with your local PC or another cloud location. For Rclone, the data export will look like this:

![Rclone configuration workflow showing terminal commands for SharePoint setup alongside Microsoft OAuth permissions dialog requesting file access for the rclone application.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1770117223189.svg align="center")

Regular users rarely use external applications to interact with SharePoint, especially CLI tools like Rclone. Thus, you can start by alerting on new applications on a per-user basis. To do this, focus on the **ApplicationDisplayName** and **UserAgent** fields, which are present in all file-related records. Below are the logs generated when running the Rclone commands shown in the illustration above:

![Splunk search results showing rclone file download operations with 6 events. The table displays timestamps, user ID for Emily Turner, FileDownloaded operations, application name (rclone), application ID, and user agent information.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1770667983008.png align="center")

| **List Rclone downloads (Splunk)** |
| --- |
|  |

```c
index=* rclone Operation=FileDownloaded
| table _time UserId Operation ApplicationDisplayName ApplicationId UserAgent
```

### Answer the questions below

Which M365 event is generated every time the file is downloaded? `FileDownloaded`

Which M365 field can you use to identify the application behind the event? `ApplicationDisplayName`

## Detecting SharePoint Abuse

## **SharePoint as an Attack Tool**

Imagine you are an attacker who has compromised the account of a B2B Sales Lead. You discover a CSV file containing hundreds of partner email addresses, including contacts from large, well-known companies. How can this be abused? You could launch a phishing campaign on all addresses while impersonating the Sales Lead. And to bypass anti-phishing controls, you can send the emails via SharePoint!

![Outlook email showing Emily Turner sharing a document titled "contract-updates" with Mark Spencer. The email displays an invitation to view a file with a document preview icon at the bottom of the message.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1769735878421.png align="center")

Whenever you share a file via SharePoint, the recipient receives a notification email sent from your account. An attacker can abuse this by creating a document inside the compromised SharePoint (often a **OneNote** file), embedding malicious instructions or links, and sharing it with targeted victims. Because both email servers and users usually trust these notifications, SharePoint becomes a tool for distributing malware or phishing. The screenshot above is a classic example of this attack.

## Detecting SharePoint Abuse

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/37c669d8-471a-4b3e-a068-780932ad6a37.png align="center")

If you fail to notify all sharing recipients in time, your company may start a supply chain attack. For example, if an IT firm in Europe is breached, attackers may share malware with its retail clients in the USA. If lateral movement succeeds, the same attack can then spread from the retailer to its supplier, a larger manufacturer in Asia. It is essential to secure not only yourself, but also all partners and clients your company could affect.

## **Advanced SharePoint Abuse**

Note that M365 logging can be confusing at times, and attackers are often very creative. For example, instead of creating a new file, they may backdoor an existing one (which results in a **FileModified** event). They can also lure other users into creating and sharing malware, which will mess up the logs. This is why, during an incident, you should review all activities in a chronological timeline instead of simply searching for specific events or indicators.

### Answer the questions below

Which file type is often abused to share phishing through SharePoint? `OneNote`

Which event is generated when someone shares a file with an external user? `AddedToSecureLink`

## Real-World Scenario

The phone rings, it's the SOC manager:

"Hey, quick one: our CEO, Michael, wants us to look into a OneNote file that was just shared by Emma Lawson, our Head of Customer Relationships. The file seems suspicious, and he can't recall approving any pricing updates. Before your shift ends, could you take a look and make sure everything is clean? I'll forward you the screenshots Michael sent me; check your inbox:"

![Split screen showing a phishing flow: Left side displays a file sharing invitation from Emma Lawson for a document about pricing updates. Right side shows the file content, a DocuSign-themed document called "Important Updates Regarding Pricing" requesting M365 login and contract review.](https://tryhackme-images.s3.amazonaws.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1770131733921.png align="center")

**Practice**  
For this task, start with the `index=challenge` query and search for **All Time**.  
You will need all the knowledge you have acquired to handle the incident!

### Answer the questions below

When did Michael open the shared OneNote file?  
Answer Example: 2026-02-01 12:30:45

```shell
index=challenge user="michael.els@tryhackme.thm" shared
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/d53a6ba4-0a7a-454b-9235-754c99123818.png align="center")

With which three external emails did Emma share the file, too?  
Answer Format: Emails via comma, alphabetical order

```shell
index=challenge user="emma.lawson@tryhackme.thm" action=shared
```

returned the internal emails, but we need the external ones, which it doesn't show with this query

```shell
index=challenge AddedToSecureLink user="emma.lawson@tryhackme.thm"
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/7db06f27-fe3e-41e3-a395-e59ef81d0b04.png align="center")

```shell
index=challenge user="emma.lawson@tryhackme.thm" AddedToSecureLink 
| stats count by TargetUserOrGroupName 
| sort -count
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/46be0cd9-a632-4e33-bfa8-c57be9af2f4d.png align="center")

One of the users from Question 2 already accessed the malicious file.  
What **CorrelationId** value proves that the sharing link has been opened?

```shell
index=challenge Operation IN(*LinkUsed, FileAccessed) ObjectId="https://tryhackme.sharepoint.com/sites/marketing/Shared Documents/Important Updates Regarding Pricing [B2B and B2E]" 
| stats values(UserId)
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/07f8d99f-f402-455a-844d-537623dbd3fa.png align="center")

```shell
index=challenge Operation IN(*LinkUsed, FileAccessed) ObjectId="https://tryhackme.sharepoint.com/sites/marketing/Shared Documents/Important Updates Regarding Pricing [B2B and B2E]"
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/fae4d49d-d0bb-4829-ab79-c4b92780bd19.png align="center")

Before sharing the malicious file, attackers reviewed Emma's SharePoint.  
Which PowerPoint presentation file did they exfiltrate?  
  
Remember the file extension of powerpoint presentation file is `.pptx` so this helps us narrow down the search in the search query

```shell
index=challenge pptx
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/81bedf57-62b1-4d15-8884-3a6d97668e1c.png align="center")

According to Entra ID logs, from which city was the malicious login performed?

```shell
index=challenge location
```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/07ad0aa2-db26-45e2-b4b2-df05c0ec93d7.png align="center")

## Conclusion

Congratulations on completing the room! With this final knowledge piece on SharePoint monitoring, you are now equipped to onboard, monitor, and protect Entra ID and M365 environments against a wide range of emerging threats. We hope you enjoyed both this room and the entire module!