High Volume SharePoint Sharing Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•3

This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.