Mass SharePoint/OneDrive file download or bulk access by single user
Detects a single user account downloading or accessing a high volume of files (more than 50) within a 15-minute window from SharePoint or OneDrive. This behavior often indicates automated data collection, potential mass exfiltration, or a compromised user account account accessing sensitive files in bulk.
Microsoft Sentinel (KQL)
