Was just coming here to ask about this and saw your thread. We had an account get compromised. Instead of attaching the file to an email (because our AV was knocking it down), they simply used the file storage and used a link in the email.

 

I assume that a resident scanner would have picked it up, but we exclude the entire SM data storage drive from Windows Defender.

 

It was a .doc file that had some downloader embedded in it.