Excel looked up a SharePoint lookalike
Group Sysmon DNS events (22) by process and name. Find the lookalike domain Excel resolved, the process that kept resolving it every 30 minutes, and the address it pointed to.
Briefing
Sysmon event 22 records every DNS query a process makes, with the answer. Because it names the process, it shows which program talked to which domain even when the connection is encrypted.
The real SharePoint tenant is corpexample.sharepoint.com. A user opened a spreadsheet from a shared link this morning.
WKS-0188 · Sysmon triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.