New SharePoint flaws help hackers evade detection when stealing files

Researchers at Varonis identified two simple techniques that let attackers bypass or downgrade SharePoint audit logs to enable stealthy data exfiltration: (1) using SharePoint's "Open in App" to generate benign "Access" events instead of "FileDownloaded", and (2) spoofing User-Agent strings (e.g., SkyDriveSync) so downloads are logged as sync events (FileSyncDownloadedFull). Both methods can be automated via PowerShell, were disclosed to Microsoft and rated moderate severity for future patching, and defenders are advised to monitor for high volumes of access, unusual device/location activity, and anomalous sync patterns.