Targeted user deleting/recycling OneDrive or SharePoint files
Detects high-volume deletion or recycling of files within OneDrive or SharePoint for a specific user, which may indicate malicious activity such as data destruction, ransomware, or unauthorized data exfiltration staging.
Microsoft Sentinel (KQL)
