Non-Anonymous Office 365 File Download Detection

Google SecOps@GoogleSecOps

•updated Apr 1, 2025•0•48

This rule detects file downloads from Office 365 or Microsoft Graph Activity logs, specifically excluding anonymous file links. It looks for 'FileDownloaded' events from Office 365 and HTTP GET requests with a 302 response code from Microsoft Graph Activity, ensuring the download is not initiated by an anonymous user.