Mass SharePoint/OneDrive File Download by Single User (T1530)
Detects bulk file access, download, or sync operations by a single user account within a 30-minute window in Microsoft SharePoint Online or OneDrive for Business. This behavior is indicative of potential data exfiltration or unauthorized mass collection of sensitive information.
Microsoft Sentinel (KQL)
