Sharepoint
Where this stands
No Sigma rule can address this — the telemetry MITRE names has no Sigma logsource behind it.
None of MITRE's analytics for this technique name a log source that maps to a Sigma logsource — they describe abstract data ("Process::None"), API-hook telemetry, or prose channels with no reliable field names behind them.
What the technique is
Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint: Policies, procedures, and standards Physical / logical network diagrams System architecture diagrams Technical system documentation Testing / development credentials (i.e., Unsecured Credentials) Work / project schedules Source code snippets Links to network shares and other internal resources
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1380
Privileged or rarely used accounts performing bulk access to SharePoint files or metadata over a short time window, indicating potential scripted collection of sensitive internal documents.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.