High Volume OneDrive Sharing Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.