SharePoint Online Forensics & Site Investigation

DFIR Investigation Charter

The Corporate Document Vault: SharePoint Online serves as the primary collaboration and file storage repository for corporate enterprises. Adversaries target SharePoint to harvest sensitive intellectual property, source code, financial spreadsheets, and strategic roadmaps. This reference card details the forensic methodology for auditing file interactions, tracking sharing links, reconstructing deleted content, and investigating automated bulk downloads.

1. SharePoint Online Architecture & Forensic Hierarchy

Understanding the hierarchical structure of SharePoint Online is critical for scoping compromise and establishing data containment boundaries.

graph TD
    subgraph TenantScope ["SharePoint Tenant Root (contoso.sharepoint.com)"]
        Hub["Hub Sites (Departmental Aggregators)"]
        CommSite["Communication Sites (Intranet Portals)"]
        TeamSite["Team Sites (M365 Group Connected)"]
        PrivSite["Private Channel Team Sites (Subordinate Collections)"]
    end

    subgraph SiteScope ["Site Collection Architecture"]
        DocLib["Document Libraries ('Shared Documents')"]
        SubLists["Lists, Pages & Application Assets"]
        Stage1["First-Stage Recycle Bin (User Accessible - 93 Days)"]
        Stage2["Second-Stage Recycle Bin (Site Admin Only)"]
        PHL["Preservation Hold Library (Retention / Legal Hold)"]
    end

    TenantScope --> SiteScope
    DocLib -->|Delete| Stage1
    Stage1 -->|Empty| Stage2
    Stage2 -->|Purge if on Hold| PHL

SharePoint Forensic Scope Matrix

Container Level	Structural Entity	Access Governance	Key Audit Records	Forensic Significance
Tenant	Tenant Admin (-admin.sharepoint.com)	SharePoint Administrator	SiteCollectionCreated, SiteDeleted	Global tenant configuration and cross-site policies
Site Collection	Site URL (/sites/Finance/)	Site Collection Administrators	SiteCollectionAdminAdded, GroupAdded	Master administrative boundary; contains recycle bins
Document Library	Document Store (/sites/Finance/Documents)	Library Permissions / Broken Inheritance	FolderCreated, LibraryDeleted	Primary staging ground for corporate document repositories
Item / File	Blob Object (.docx, .xlsx, .pdf)	Unique File Permissions / Sharing Links	FileAccessed, FileDownloaded, SharingSet	Proves direct document interaction or exfiltration
Preservation Layer	Preservation Hold Library	Inaccessible to standard users	FileVersionsAllDeleted, HardDelete	Immutable snapshots of items modified during legal hold

---

2. File Telemetry: Accessed vs Downloaded

In Purview UAL, distinguishing between previewing a document in the browser and physically downloading it to an endpoint is vital for legal breach notification standards.

flowchart TD
    UserAction[User Interacts with Document] --> Path{Access Modality}

    Path -->|Browser View / WopiFrame| Preview[Office Online / WOPI Viewer]
    Preview --> Ev1["FileAccessed (ExtendedProperties: WOPI)"]
    Note over Ev1: Document rendered server-side; NO local file copy created

    Path -->|Direct Download| Download[Direct HTTP GET to /_layouts/download.aspx]
    Download --> Ev2["FileDownloaded (Client: Browser / Tool)"]
    Note over Ev2: File transferred to endpoint; physical exfiltration proven

    Path -->|Multi-File Download| ZipDownload[Bulk Download as ZIP Archive]
    ZipDownload --> Ev3["FileDownloaded (UserAgent: OneDriveBrowserSync / Archive_Zip)"]
    Note over Ev3: Multiple files aggregated into single outbound compressed stream

Critical File Operation Events in Purview UAL

Operation	Trigger	Forensic Evidence Provided	Exfiltration Weight
FileAccessed	Document opened in browser via Office Online, or synced metadata viewed	Confirms document exposure and reading window	Observed (Tier 6)
FileDownloaded	Explicit file download to local filesystem	Proves binary transfer across tenant boundary	Proven (Tier 7)
FileModified	File content altered, metadata updated, or encrypted (ransomware)	Identifies data tampering or extortion staging	Proven (Tier 7)
FileDeleted	Item moved to First-Stage Recycle Bin	Anti-forensic cleanup or mass deletion	Observed (Tier 6)
FileRecycled	Item sent to First-Stage Recycle Bin from web UI	User-driven deletion	Observed (Tier 6)
FileVersionRestored	Prior version rolled back	Remediation or tampering recovery	Observed (Tier 6)

---

3. Sharing Link & Permission Forensics

Adversaries abuse SharePoint sharing links to bypass perimeter firewalls and exfiltrate documents without generating anomalous sign-in logs from unusual geolocations.

sequenceDiagram
    autonumber
    actor Attacker as Threat Actor (Compromised User)
    participant SPO as SharePoint Online Site
    participant ExtActor as External Harvester (VPN / Tor)
    participant UAL as Purview Unified Audit Log

    Attacker->>SPO: Request anonymous sharing link for Finance folder
    SPO->>UAL: Log 'AnonymousLinkCreated' (Target: /sites/Finance)
    SPO-->>Attacker: Return tokenized guest URL (https://contoso.sharepoint.com/:f:/g/...)
    Attacker->>ExtActor: Exfiltrate guest link over external C2 channel
    ExtActor->>SPO: HTTP GET via guest link (No login required!)
    SPO->>UAL: Log 'AnonymousLinkUsed' & 'FileDownloaded' (User: 'Guest')
    Note over UAL: FileDownloaded event logged under 'urn:spo:guest' identity!

Auditing Anonymous Link Artifacts

When an anonymous link is utilized, the UserId in the audit log will reflect a guest token or anonymous identity:

{
  "UserId": "urn:spo:guest#12345678-abcd-1234-abcd-1234567890ab",
  "UserType": "Guest",
  "Operation": "FileDownloaded",
  "SourceFileName": "Merger_Terms.pdf",
  "ClientIP": "198.51.100.45",
  "UserAgent": "python-requests/2.31.0"
}

---

4. Recycle Bin & Anti-Forensics Analysis

When adversaries stage destructive attacks or attempt to conceal intellectual property theft, they systematically clear recycle bins:

1. First-Stage Recycle Bin (_layouts/15/AdminRecycleBin.aspx):
   • Stores items deleted by users. Retained for 93 days.
   • Files can be restored by the user or site administrator.
2. Second-Stage Recycle Bin (Site Collection Admin):
   • When an attacker deletes items from the First-Stage Recycle Bin, they move to the Second-Stage Recycle Bin.
   • Still retained within the 93-day overall window from initial deletion.
3. Preservation Hold Library (PHL):
   • If a Purview Retention Policy, Litigation Hold, or eDiscovery Hold applies to the site, purging items from the Second-Stage Recycle Bin moves them into the hidden PreservationHoldLibrary.
   • Immutable Protection: Files in the PHL cannot be deleted by any user or administrator until the retention duration expires.

# Restore items deleted by an attacker from the Second-Stage Recycle Bin
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/Finance" -Interactive
Get-PnPRecycleBinItem -SecondStageOnly | Where-Object {$_.DeletedDate -ge (Get-Date).AddDays(-7)} | Restore-PnPRecycleBinItem

---

5. Detection Engineering: SharePoint Hunting Queries

KQL: Mass File Downloads Across Sites

// Detect anomalous bulk file downloads from SharePoint
CloudAppEvents
| where TimeGenerated >= ago(7d)
| where ActionType == "FileDownloaded"
| extend Workload = tostring(RawEventData.Workload)
| where Workload =~ "SharePoint"
| extend SiteUrl = tostring(RawEventData.SiteUrl)
| extend FileName = tostring(RawEventData.SourceFileName)
| extend Extension = tostring(RawEventData.SourceFileExtension)
| summarize
    DownloadCount = count(),
    DistinctFiles = dcount(FileName),
    Extensions = make_set(Extension, 10),
    Sites = make_set(SiteUrl, 5)
    by AccountDisplayName, IPAddress, bin(TimeGenerated, 1h)
| where DownloadCount > 50 or DistinctFiles > 30
| sort by DownloadCount desc

KQL: Tracking Anonymous Link Abuse

// Correlate anonymous link creation with subsequent guest file downloads
let AnonLinks = CloudAppEvents
| where TimeGenerated >= ago(14d)
| where ActionType == "AnonymousLinkCreated"
| extend SiteUrl = tostring(RawEventData.SiteUrl)
| extend ObjectId = tostring(RawEventData.ObjectId)
| project LinkTime = TimeGenerated, Creator = AccountDisplayName, CreatorIP = IPAddress, SiteUrl, ObjectId;
CloudAppEvents
| where TimeGenerated >= ago(14d)
| where ActionType == "FileDownloaded" and RawEventData.UserType =~ "Guest"
| extend TargetObject = tostring(RawEventData.ObjectId)
| join kind=inner (AnonLinks) on $left.TargetObject == $right.ObjectId
| project TimeGenerated, Creator, CreatorIP, DownloaderIP = IPAddress, TargetObject, RawEventData
| sort by TimeGenerated desc

PowerShell: Audit Site Collection Administrators

<#
.SYNOPSIS
    Audits all Site Collection Administrators across the tenant to detect privilege escalation.
#>
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

$Sites = Get-SPOSite -Limit All
foreach ($Site in $Sites) {
    $Admins = Get-SPOUser -Site $Site.Url | Where-Object {$_.IsSiteAdmin -eq $true}
    foreach ($Admin in $Admins) {
        [PSCustomObject]@{
            SiteUrl    = $Site.Url
            AdminUser  = $Admin.LoginName
            IsGroup    = $Admin.IsGroup
        }
    }
}

---

6. Incident Response Playbook: Step-by-Step Triage

1. Freeze Site Deletions & Activate Preservation Holds: Immediately apply a tenant-wide Purview retention hold to all SharePoint sites to ensure all modified and deleted files are captured in the Preservation Hold Library:

   New-ComplianceSecurityFilter -FilterName "IR_Freeze_Hold" -SecurityFilterAction All

2. Revoke All External and Anonymous Sharing Links: Iterate through affected document libraries and dismantle all anonymous links:

   # Disable anonymous sharing tenant-wide or per-site
   Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" -SharingCapability ExistingExternalUserSharingOnly

3. Audit Elevated Site Permissions: Inspect UAL for SiteCollectionAdminAdded and RoleAssignmentAdded events to ensure the adversary did not grant administrative rights to rogue guest accounts.

4. Reconstruct Downloaded File Inventory: Extract the complete list of files with FileDownloaded events associated with attacker IP addresses during the breach window to establish the precise exfiltration manifest.

---

7. Related Intelligence & Cross-References

32. Microsoft 365 Data Attack Surface Mapping Understand multi-workload exposure vectors and the evidentiary threshold ladder.

35. OneDrive Forensics & Sync Exfiltration Analyze personal drive forensics and endpoint sync client exfiltration.

36. Microsoft Teams Forensics Explore how Teams channel files correlate directly with SharePoint Team sites.

37. Data Access Paths & Blast Radius Calculate exact exfiltration exposure and construct defensible incident response reports.