Bulk SharePoint/OneDrive FileAccessed/FileDownloaded exfiltration

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•1

Detects anomalous high-volume file access or download activity in Microsoft 365 (SharePoint or OneDrive) by a single user within a 15-minute window, which may indicate bulk data exfiltration.