SharePoint Online

How to Track Malware-Infected Files in SharePoint Online

As a key collaboration platform, SharePoint Online requires vigilant security. Thus, Microsoft 365 Defender scans files for threats and prevents accessing or sharing the infected files. However, monitoring malware-infected files is crucial to trace the origin of the threat, stop it from spreading, and take action to restore any affected content. This guide helps you to find malware-infected files in SharePoint Online and enhance security.

Monitor Malware Detected Files in SPO Using Microsoft 365 Defender

Microsoft 365 Permission Required

Security Reader Least Privilege

Global Administrator Most Privilege

Sign in to the Microsoft 365 Defender portal.
Navigate to the Explorer under the Email & collaboration drop-down.
In Explorer, switch to the Content Malware tab. Apply the SharePoint workload filter and click Refresh to monitor malware detected files within SharePoint Online.

Monitor Malware Detected Files in SPO Using Microsoft 365 Defender

This report shows key data such as date, file name, threat, detection technology, last modified user, file owner, and file size.

Find SharePoint Malware Detection Logs Using Microsoft Purview

Microsoft 365 Permission Required

View-Only Audit Log role Least Privilege

Global Administrator Most Privilege

Log in to the Microsoft Purview portal and navigate to Solutions»Audit.
Enter FileMalwareDetected in the "Activities - operation names" field and select SharePointFileOperation in the Record Types field.
Customize Start & End date range and hit Search.

Find SharePoint Malware Detection Logs Using Microsoft Purview

This generates a report of detected malware in SharePoint Online files with details such as IP address, user, record type, activity, and item (file path).

Note: You need to have an Audit Premium license to access audit logs older than the default period of 180 days.

Track SharePoint Malware Detected Files Using PowerShell

Microsoft 365 Permission Required

View-Only Audit Log role Least Privilege

Global Administrator Most Privilege

Connect to the Exchange Online PowerShell module using the below cmdlet.
Windows PowerShell
```
 Connect-ExchangeOnline
```
Run below PowerShell cmdlet to audit malware-infected files in SharePoint Online. Replace the "MM-DD-YYYY" in StartDate and EndDate parameters before executing the audit search.

Windows PowerShell

 Search-UnifiedAuditLog -StartDate "<MM-DD-YYYY>" -EndDate "<MM-DD-YYYY>" `
  -RecordType SharePointFileOperation -Operations FileMalwareDetected | 
ForEach-Object {
	$data = $_.AuditData | ConvertFrom-Json 
	[PSCustomObject]@{ 
		CreationDate = $_.CreationDate 
		FileName = $data.SourceFileName 
		Operation = $_.Operations 
		RecordType = $_.RecordType 
		FileOwner = $data.UserId 
		SitePath = $data.SiteUrl 
		VirusInfo = $data.VirusInfo
	}
} | Format-Table -AutoSize

The audit report of malware detected files provides details such as creation date, file name, operation, record type, file owner, site path, and virus info.

Note: By default, EndDate is set to 00:00:00, which excludes the current day from audit search results. To include logs up to a specific time, set EndDate with the timestamp (i.e, MM-DD-YYYYZHH:MM:SS GMT) or push EndDate to the next day.

Simple & Quick
Audit Malware-Infected SPO Files Using AdminDroid

AdminDroid Permission Required Delegated

Any user with audit access delegated by the Super Admin.

Sign in to AdminDroid 365 portal.
Navigate to the Malware-Infected Files in SharePoint report under Reports»SharePoint»Deep Insights»All File and Folder Insights»Malware Files»All Files.
Click the "Select All" checkbox to include all SharePoint sites for malware files report generation.
Here, you can view detailed insights into malware-infected files in SharePoint Online, such as malware file name, site URL, document library name, file type, and more.

Audit Malware-Infected SPO Files Using AdminDroid

Note: Admins must enable SharePoint Online Deep Insights for sites to view the malware-infected files report and their related details.

AdminDroid SharePoint Online Reporter

Monitor Malware Files Effectively to Implement Robust Protection in SharePoint Online

AdminDroid’s SharePoint Online auditing tool provides full insights into potential malware threats across your M365 organization. It delivers in-depth reports on malware-infected files, file/folder management, site traffic, external sharing, permission assignments, etc. With these reports, admins can proactively monitor incidents, respond faster, and maintain a secure SharePoint Online environment.

Get Alerts on Malware File Detections in SharePoint Online

Use the default malware detection in SharePoint and OneDrive files alert policy template to get notified of flagged files which helps to quickly investigate, limit access, etc, to prevent further spread.

Audit SharePoint File Activity to Identify Malware File Downloads

Track SPO file downloads report to find any infected file downloads by users before the restriction and initiate a cleanup or incident response.

Find Malware File Deletions in SharePoint Online

Check the deleted malware files report to verify the removed infected files and ensure risks are neutralized in SharePoint Online.

Monitor Files Shared with External Users For Undetected Malware Spreads

Audit the files and folders shared with external users to check if any undetected malware files are shared with external users, and take action to contain any potential exposure.

Track Created Files to Detect Malware Sources in SPO

Monitor the files created by internal users to identify the user responsible for malware infection and take appropriate actions to contain the threat.

Monitor Auto-Saved Email Attachments to SharePoint Online for Malware Detection

Track malware-infected emails in Microsoft 365 to prevent malicious attachments from being auto-saved to SPO and spread across your organization.

In summary, AdminDroid SharePoint Online management tool provides advanced features that enable admins to track malware-infected files in SharePoint Online efficiently. Admins can also monitor file activity, performance metrics, top content activity, storage monitoring, and more to maintain proactive control over malware-infected files.

Explore a full range of reporting options

Download Live Demo

Important Tips

Use the advanced hunting tool in Microsoft Defender to expand malware investigations, analyze infection patterns, identify threat indicators across your network, etc.

Identify safe versions for file restoration after ransomware and other malware threats through intelligent versioning in SharePoint Online.

Limit external sharing at the tenant and site level to reduce the risk of external compromise by accidental spread of undetected malware.

Common Errors and Resolution Steps

The following are the possible errors and troubleshooting hints while tracking malware-infected files in SharePoint Online.

Error "Get-SPOMalwareFile : Server relative urls must start with SPWeb.ServerRelativeUrl"

This error occurs when a shared URL is provided as input for the Get-SPOMalwareFile cmdlet instead of a server-related URL.

Fix When you copy the file URL from the desired SharePoint site, the shared URL comes with the sharing path and query parameters.

Configure the shared URL into a server-relative URL by removing the sharing path (:u:/r/) and query params (?csf=6&web=3&e=HSsDE8) and ensure the file URL is as below.

// Direct server-related URL: 
https://<tenant-name>.sharepoint.com/sites/<site-name>/Shared%20Documents/<malware-file-name>

Error The term 'Search-UnifiedAuditLog' is not recognized as a name of a cmdlet, function, script file, or executable program.

This error occurs when the Exchange Online PowerShell module is not installed/imported properly before establishing a connection.

Fix Install and import the ExchangeOnlineManagement module before connecting in PowerShell.

Install-Module ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline

Error Cannot process argument transformation on parameter 'StartDate'. "String '02-05-2025' was not recognized as a valid DateTime."

This error occurs when executing the Search-UnifiedAuditLog cmdlet with unsupported or unrecognized date formats in Exchange Online PowerShell.

Fix Confirm that the given date format is in "YYYY-MM-DD" or "MM-DD-YYYY" while performing the audit search in PowerShell.

Error "To use this feature, turn on auditing so we can start recording user and admin activity in your organization. When you turn on auditing, activity is recorded in the audit log and is available to view in a report."

This error occurs when auditing is disabled and no admin activity is recorded in your organization.

Fix Enable admin audit logging for your organization using the Microsoft Purview portal.

SharePoint Online

Frequently Asked Questions

Track Malware-infected Files and Respond Swiftly to Insider Threats in SharePoint Online

What happens when a malware-infected file is detected in SharePoint Online?

How to monitor quarantined malware files in Microsoft Defender?

How to restrict download access to malware files in SPO?

How to extract the malware-infected SPO file after restricting the download access?

How to handle false malware detections in SharePoint Online?

How to report a malware activity in SharePoint Online?

1. What happens when a malware-infected file is detected in SharePoint Online?

When Microsoft 365 Defender finds a new file in SharePoint Online, it scans the file for any malicious activity, unknown data, file corruption, etc. If anything suspicious is found, the Defender tags the file as malware and does the following.

Malware detected files in SharePoint Online workspace

Microsoft Defender flags the malware-infected files with a red shield icon next to the More options menu for user identification.
Once Defender flags the file as malware-infected, these files are quarantined to prevent Microsoft 365 tenant users from viewing, copying, moving, or sharing.
Admins can monitor these quarantined malware-infected files in Microsoft 365 Defender and take appropriate action such as deleting the file, marking it as a false positive, submitting it for analysis, and more.

malware-file-identity-in-sharepoint-online

Note: Admins can also manually investigate the incident and submit the evidence to Microsoft instead of relying on the Automated Investigation and Response (AIR) models.

2. How to monitor quarantined malware files in Microsoft Defender?

Malware-infected files are quarantined immediately when flagged by Microsoft 365 Defender. Monitoring quarantined malware SPO files ensures that real threats are handled quickly and false positives are identified. It helps admins to verify threats, restore safe files, and maintain a strong security posture.

To monitor all the quarantined malware files in Microsoft 365 Defender, follow the steps below.

Sign in to the Microsoft 365 Defender portal and navigate to the Review section under Email & collaboration.
Select the Quarantine option and switch to the Files tab. This page provides the details such as the user, location, attachment file name, file URL, etc.
Click on the desired file row to view detailed information about the quarantined file in a flyout pane.
The details pane allows admins to take three actions on quarantined malware SPO files. They are,
- Release file - With this option, you can mark the quarantined malware file as safe and report it to Microsoft for security verification.
- Download file - This allows you to retrieve a copy of the malware file, which asks to set a password and specify the reason for downloading the file.
- Delete from quarantine - You can remove the malware-infected file from quarantine permanently, irrespective of the release status using this option.

These actions do not impact the original infected file in SPO and remain blocked until Microsoft considers it as non-malicious from their analysis.

monitor-quarantined-files-using-defender

Note: These quarantined files have an expiration policy of 30 days. Once the file is expired or deleted from quarantine, it is no longer available and cannot be restored for any malware analysis.

3. How to restrict download access to malware files in SPO?

By default, users can still download the infected file from the respective SharePoint site even though the file is blocked from being copied, moved, or shared. The infected files appear in the document library across various device applications, which increases the chance of users meddling with the infected files. So, restricting the download access to infected files is critical and stands on the admin’s priority list.

The download restriction can be enforced only using PowerShell, as there is no setting available in the SharePoint admin center.

Execute the following cmdlets to block the malware file downloads for Microsoft 365 users.

Open Windows PowerShell and connect to the SharePoint Online service using the cmdlet below.
```
Connect-SPOService -Url <SharePointAdminCenterURL>
```
Replace the URL parameter with your SharePoint admin center URL before executing the cmdlet in the PowerShell session.
Execute the ‘Set-SPOTenant’ command with the DisallowInfectedFileDownload param set to true for restricting the malware file downloads.
```
Set-SPOTenant -DisallowInfectedFileDownload $true
```
Use the below Get-SPOTenant cmdlet to check if the download access has been restricted for M365 tenant users.
```
Get-SPOTenant | Format-List DisallowInfectedFileDownload
```

Note: This download restriction targets all Microsoft 365 users in your organization, including admins and affects within 15-20 minutes.

4. How to extract the malware-infected SPO file after restricting the download access?

After restricting the download access to infected files for your Microsoft 365 organization, the users and admins are fully isolated from downloading the infected files in SharePoint Online. This prevents the users from spreading the infection across the endpoint devices and the secured workspace.

However, admins may need to download the infected files for forensic analysis and they do not need access to Sites that host the infected content. As long as the file is marked as malware, admins can extract these files from SPO using the Get-SPOMalwareFileContent cmdlet in a PowerShell session.

Download quarantined malware SPO file with PowerShell

Open Windows PowerShell and connect to the SPO service.
```
Connect-SPOService -Url <SharePointAdminCenterURL>
```
Now, retrieve the malware file URL from the Alerts in Defender portal and replace the <FileURL> with it.

Once replaced the URL, configure the output path and run the following cmdlet to save the malware content locally.

$MalwareFileUri = "<FileURL>"
$FileName = $MalwareFileUri.split("/")[-1]
$OutputPath = "<OutputPath>\$FileName"
$TargetFile = [System.IO.File]::Create($OutputPath)
$MalwareFile = Get-SPOMalwareFile -FileUri  $MalwareFileUri
$Stream = Get-SPOMalwareFileContent -MalwareInfectedFile $MalwareFile
$Stream.CopyTo($TargetFile)
$TargetFile.Close()

The Get-SPOMalwareFile cmdlet gets the metadata of the malware-infected file from SPO. The Get-SPOMalwareFileContent cmdlet extracts the content of the malware-infected file using the metadata and saves it in the specified output path.

This Get-SPOMalwareFileContent cmdlet is limited to Global Admins and SharePoint Admins Only. Alternatively, use the Download file action from Quarantine in Microsoft 365 Defender, which allows all privileged roles to extract infected file contents.

5. How to handle false malware detections in SharePoint Online?

Sometimes, the files uploaded by users may be falsely flagged as malware in SPO due to sync issues, upload errors, or corruption. Admins should create an alert policy in Microsoft Defender to review such files.

If a file is deemed safe, you can release it from quarantine and report the file to Microsoft as a false positive for further analysis.

Manage SPO malware alerts and false positives in Microsoft 365 Defender

Log in to the Microsoft Defender portal and navigate to Investigation & response»Incident & alerts»Alerts.
Click Add filter, choose Alert type, and set it to the malware alert policy you created to view the relevant alerts.
Click on the alert name to handle false positives in Microsoft 365 Defender.
Select Set Classification, choose False-positive from the Classification drop‑down, and then click Save.

This action flags the file as not malicious in similar future detections. However, it remains blocked until Microsoft completes its security analysis. If confirmed safe, the malware flag is revoked from SharePoint Online.

6. How to report a malware activity in SharePoint Online?

During routine collaboration in SharePoint Online, admins may come across suspicious file activity such as unusual file names, file behaviours, unknown uploads, etc. Whether it's a known threat or just a suspicious-looking file, it's important to take immediate action. Reporting the activity to Microsoft ensures it gets escalated for analysis and helps to protect the Microsoft 365 tenant workspace from potential spread.

Report SharePoint Online malware file activity in Microsoft Defender

Log in to the Microsoft 365 Defender portal.
Navigate to Investigation & response»Actions & submissions»Submissions.
Click on Submit to Microsoft for analysis and enter the file URL in the URL field.
Under Why are you submitting this URL to Microsoft?, Choose It appears suspicious and click Submit to report the file as suspicious in SharePoint Online.

These submissions send the undetected file URL to Microsoft and allow you to set a temporary block if you confirm it as a threat. Similarly, you can submit a request to Microsoft regarding false positive detections and set a temporary unblock if you confirm it as clean.

However, the false positives will only be unblocked permanently after Microsoft completes its malware analysis.

How to Track Malware-Infected Files in SharePoint Online

Monitor Malware Detected Files in SPO Using Microsoft 365 Defender

Find SharePoint Malware Detection Logs Using Microsoft Purview

Track SharePoint Malware Detected Files Using PowerShell

Simple & Quick Audit Malware-Infected SPO Files Using AdminDroid

Monitor Malware Files Effectively to Implement Robust Protection in SharePoint Online

Get Alerts on Malware File Detections in SharePoint Online

Audit SharePoint File Activity to Identify Malware File Downloads

Find Malware File Deletions in SharePoint Online

Monitor Files Shared with External Users For Undetected Malware Spreads

Track Created Files to Detect Malware Sources in SPO

Monitor Auto-Saved Email Attachments to SharePoint Online for Malware Detection

Important Tips

Use the advanced hunting tool in Microsoft Defender to expand malware investigations, analyze infection patterns, identify threat indicators across your network, etc.

Identify safe versions for file restoration after ransomware and other malware threats through intelligent versioning in SharePoint Online.

Limit external sharing at the tenant and site level to reduce the risk of external compromise by accidental spread of undetected malware.

Common Errors and Resolution Steps

Error "Get-SPOMalwareFile : Server relative urls must start with SPWeb.ServerRelativeUrl"

Error The term 'Search-UnifiedAuditLog' is not recognized as a name of a cmdlet, function, script file, or executable program.

Error Cannot process argument transformation on parameter 'StartDate'. "String '02-05-2025' was not recognized as a valid DateTime."

Error "To use this feature, turn on auditing so we can start recording user and admin activity in your organization. When you turn on auditing, activity is recorded in the audit log and is available to view in a report."

Track Malware-infected Files and Respond Swiftly to Insider Threats in SharePoint Online

1. What happens when a malware-infected file is detected in SharePoint Online?

Malware detected files in SharePoint Online workspace

2. How to monitor quarantined malware files in Microsoft Defender?

3. How to restrict download access to malware files in SPO?

4. How to extract the malware-infected SPO file after restricting the download access?

Download quarantined malware SPO file with PowerShell

5. How to handle false malware detections in SharePoint Online?

Manage SPO malware alerts and false positives in Microsoft 365 Defender

6. How to report a malware activity in SharePoint Online?

Report SharePoint Online malware file activity in Microsoft Defender

Kickstart Your Journey With AdminDroid

Simple & Quick
Audit Malware-Infected SPO Files Using AdminDroid

Kickstart Your Journey With
AdminDroid