O365 OneDrive Anonymous Link Accessed
This rule detects when anonymous links are used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'AnonymousLinkUsed' as the product event type, originating from 'Office 365' and 'Microsoft', where the user ID is 'anonymous'.
YARA-L
