Sharepoint built-in virus protection

Posted by Det_23324@reddit | sysadmin | View on Reddit | 15 comments

In our weekly cybersecurity meeting, we had a discussion on whether sharepoint has some kind of built in virus protection. No one seemed to know and google searching didn't seem to come up with great answers. If I upload a virus to SharePoint will it get flagged and blocked? Is the only way it will get blocked is if I purchase Microsoft defender for Office 365 or will it get blocked by default? I was hoping someone else ran into this at some point. Also for that matter, is it worth it to look at something such as Microsoft defender for Office 365 even though we already have a few pretty robust security solutions in place. (AV and cloud web filter) Thanks

Reply to Post

15 Comments

[-]

Areaman6@reddit

Also, I restrict some extensions from syncing with the service like uncommon file formats and commonly abused script extensions.

[-]

CetiAlphaFiver@reddit

The question is this: if you have a Sharepoint synched folder on your desktop and it starts getting encrypted, will the encrypted files synch to Sharepoint. It’s highly doubtful that an encryption routine would actually start on Sharepoint.

[-]

Doso777@reddit

Sharepoint on-prem recently got AMSI integration. This allows http/https requests to be scanned server side by AV software like Windows Defender: https://learn.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/configure-amsi-integration

[-]

firozaulz@reddit

MS has documentation on this - https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-for-spo-odfb-teams-about#what-happens-if-an-infected-file-is-uploaded-to-sharepoint-online

[-]

Det_23324@reddit (OP)

Thanks. I saw that The part that confused me is this **Applies to** * [Exchange Online Protection](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/eop-about?view=o365-worldwide) * [Microsoft Defender for Office 365 plan 1 and plan 2](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/defender-for-office-365?view=o365-worldwide) So if you have neither of these plans...are you not protected?

[-]

firozaulz@reddit

Are your mailboxes on prem or online?

[-]

Det_23324@reddit (OP)

O365

[-]

firozaulz@reddit

You have the protection you need in the case. EOP ( exchange online protect) is included in all Microsoft 365 organizations with Exchange Online mailboxes.

[-]

nohairday@reddit

SharePoint Online has built in detection if memory serves, in that it will do a basic scan of files and block ones that it identifies as malware, only an admin via download or access them via powershell. However, I don't have any details as to what level of detail it goes into, or if it's a fairly basic check, MS just say it has built in security. As with everything, if you're giving sharepoint access to external users, or users can download what they want from t'interweb and upload it to sharepoint, they're your points of entry, rather than sharepoint itself. If you're talking about on premise sharepoint server, I don't know, I'm pretty sure you can set upload filters to disallow file types, but as it's on prem, I would assume it doesn't have any antivirus solution other than what you provide.

[-]

Det_23324@reddit (OP)

Thanks for the answer. We're on office 365. We've never really considered the security of sharepoint and figured Microsoft has to do something. It sounds like they do which is good to know.

[-]

nohairday@reddit

Yes, since you don't manage the hardware, and the storage is on their systems, they have an interest in protecting their environment. I had to learn this when I was asked to provide access to a file that had been marked as malware. Not access in sharepoint, but get a copy of the file and provide it for detailed analysis by the security team. The Sharepoint online powershell cmdlet you need is Get-SPOMalwareFile and Get-SPOMalwareFileContent

[-]

Chevron7Nice@reddit

I feel like it's blocked at the upload level - first off you typically don't allow uploads of unsafe files (like .exe for example) but I think it does scan on upload for known hashes but I could be very wrong!

[-]

Det_23324@reddit (OP)

I can confirm you can save exe in sharepoint. I do it all the time for all of our programs that we use. Whether or not, it scans them I'm not sure

[-]

DanishLurker@reddit

Uhmn.... upload an [eicar.org](https://eicar.org) test virus (harmless, but get approval none the less) - and find out.

[-]

Det_23324@reddit (OP)

Good idea