SharePoint Online Monitoring

SharePoint Online is one of the most targeted M365 services, as it often stores sensitive files and can be used to propagate the attack. This room will explore the most common attack scenarios on SharePoint Online and explain how to monitor for them as a SOC team.

Learning Objectives

• Learn Entra ID and SharePoint audit log formats
• Explore how attackers exfiltrate data from SharePoint
• Discover how SharePoint can become an attack tool
• Practice the learned topics through an attack scenario

Prerequisites

• M365 Monitoring Basics
• Entra ID Monitoring

Lab Access

Start the lab by clicking the Start Machine button below. You will then have access to the Splunk Web Interface. Please wait 4-5 minutes for the Splunk instance to launch. To access Splunk, follow this link:

• https://LAB_WEB_URL.p.thmlabs.com (opens in new tab)

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine

Status:Off

Start Machine