Microsoft 365 external sharing link
A SharePoint / OneDrive anonymous or external sharing link was created.
What it detects
A SharePoint / OneDrive anonymous or external sharing link was created. After a takeover, attackers share files or whole folders to an anonymous ("anyone with the link") or external address to exfiltrate data out of the tenant without an obvious download from their own account.
MITRE ATT&CK mapping
False positives and triage
External collaboration uses sharing links legitimately. The signal is anonymous ("anyone") links, links to unknown external addresses, bulk link creation, or sharing right after a suspicious sign-in. Confirm the recipient and the file.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_external_sharing_link.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_external_sharing_link
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1537, T1213.002]
description: |
A SharePoint / OneDrive anonymous or external sharing link was created. After a
takeover, attackers share files or whole folders to an anonymous ("anyone with
the link") or external address to exfiltrate data out of the tenant without an
obvious download from their own account.
match:
provider: Office365
event_action_any:
- AnonymousLinkCreated
- SecureLinkCreated
- AddedToSecureLink
- SharingInvitationCreated
- CompanyLinkCreated
- AnonymousLinkUpdated
correlation_keys: [user_name]
false_positive_guidance: |
External collaboration uses sharing links legitimately. The signal is anonymous
("anyone") links, links to unknown external addresses, bulk link creation, or
sharing right after a suspicious sign-in. Confirm the recipient and the file.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.