Targeted user deleting/recycling OneDrive or SharePoint files
Detects bulk file deletion activities (three or more files deleted or moved to the recycle bin) within SharePoint or OneDrive by a specific user within a 30-minute window, which may indicate malicious activity or data destruction.
Splunk (SPL)
