Massive File Download Activity from Anonymous Proxy
Detects high-volume file download, access, or preview activity originating from known anonymous proxy services. This behavior is indicative of potential data exfiltration or unauthorized mass data collection from cloud storage applications.
Microsoft Sentinel (KQL)
