O365 OneDrive Anonymous File Download

Google SecOps@GoogleSecOps

•updated Apr 1, 2025•0•33

This rule detects when files are downloaded from OneDrive using anonymous links. While not inherently malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'FileDownloaded' events from Office 365 where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').