O365 sharepoint-online-downloading not matching while downloading excel files

[Sec101]

The application sharepoint-online-downloading will catch word docs.   However it does not catch excel file downloads. If we block sharepoint-online-downloading - it will bock everything but excel file and powerpoint downloads.    I'm not sure why, but excel files and powerpoint come through as the app sharepoint-online ....Why?

[BPry]

Just to verify, you are decrypting all of this traffic correct? 

[Sec101]

Yes.   Decryption is working normally.   I should specify, that this is when you click on  File/save as/ "download a copy", and try to download it.   Correction - only Word docs get blocked, and marked as sharepoint-online-downloading.  Both powerpoint and  Excel documents come through, and marked as the application sharepoint-online, not sharepoint-online-downloading.  Workaround/solution is to block these files in the app sharepoint-online?

[BPry]

@Sec101,

I was able to reproduce this easily enough, so you probably want to open a ticket with TAC so they can get the application team to take a look at things. As a work around, you could assign a file-blocking profile to the rule allowing this traffic and simply deny users from downloading powerpoint or excel files if the application is identified as sharepoint-online.

[Sec101]

How many people know about this?  - if this is true - O365 environments are not as secure as once thought right now.