MalwareFileDetected.md

Malware File Detected In Office 365

Query Information

Description

This detects a malware file in your Office 365 environment.

Risk

Active malware is detected and can spread through the organisation.

References

• https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection?view=o365-worldwide

Sentinel

OfficeActivity
| where Operation == "FileMalwareDetected"
| project-reorder TimeGenerated, OfficeWorkload, SourceFileName, OfficeObjectId, UserId