SharePoint Synced Files and Ransomware

Just reporting back. Hopefully this info helps someone else.

We ended up syncing a folder with 6 PDFs and one zip file on two computers (one with Sophos Intercept X antivirus and one with Windows Defender) via a Document Library in a SharePoint site. Our coder used C# and DotNet 6 (sorry if I said that wrong, I'm not a coder) to flip all the bits in the files and rename the file extensions on the computer with Sophos. The antivirus picked up on the activity and stopped it immediately and then restored the files that did get "encrypted" before it had detected it. No syncing occurred to SharePoint.

Next we ran it on the computer with only Windows Defender. This yielded in troubling results. Windows did not pick up on the activity. All files were bit-flipped and then the file extensions were renamed to .test-encrypted. After the change, all files synced to SharePoint and then to the computer with Sophos. Sophos did not recognize this as an issue and did not raise any alerts. The files were, for all intents, ransomwared throughout the organization.

Microsoft has stated that version history is a way to protect end users from ransomware attacks. What we found was with a file extension change, version history restores the file to a previous version but it does not change the file extension back to what it was before the encryption. So even though the file was restored to a point before the "attack" the file extension was still .test-encrypted. There is no way to rename the file extension in SharePoint. Be that as it may, if you access the file through the synced folders locally, you can change the file extension back, but you have to know what it was before hand. pdf, docx, xlsx, zip, etc. 

After our testing, I did find this article by MS related to ransomware and SharePoint. 

https://docs.microsoft.com/en-us/sharepoint/troubleshoot/security/handling-ransomware-in-sharepoint-online 
MS does keep a copy of all data in SharePoint for 14 days. You will need to contact MS directly for support. *good luck there.

tldr; Unfortunately, if files get encrypted via ransomware, they will sync across the SharePoint organization. Version history can help in this case, but it is not a solid solution as one must know what the file extension was in order to change it back. Back up your data and run third party antivirus!