According to a recent discovery by Varonis Threat Labs, two new techniques have emerged that pose a significant threat to data security within SharePoint, a widely used platform for file management. These techniques enable users to evade detection and retreat files without triggering alarm bells in audit logs.
Technique 1: Open in App Method
The first technique leverages SharePoint’s “open in app” feature, allowing users to access and download files while leaving behind only access events in the file’s audit log. This method, which can be executed manually or through automated scripts, enables rapid exfiltration of multiple files without raising suspicion.
Technique 2: SkyDriveSync User-Agent
The second technique exploits the User-Agent for Microsoft SkyDriveSync, disguising file downloads as sync events rather than standard downloads. By mislabeling events, threat actors can bypass detection tools and policies, making their activity harder to track.
Implications for Security
These techniques pose a significant challenge to traditional security tools such as cloud access security brokers and data loss prevention systems. By hiding downloads as less suspicious access and sync events, threat actors can circumvent detection measures and potentially exfiltrate sensitive data unnoticed.
Microsoft’s Response
Despite Varonis disclosing these methods to Microsoft, the tech giant has designated them as a “moderate” security concern and has not taken immediate action to address them. As a result, these vulnerabilities remain in SharePoint deployments, leaving organisations vulnerable to exploitation.
Recommendation
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: