Bulk agent retrieval of credential-named files from SharePoint/OneDrive

Ibrahim Saud@tektrix

•updated 13 days ago•1•0•2

This rule detects when a user or service account accesses or downloads a high volume of files from SharePoint or OneDrive that match sensitive keywords such as 'password', 'secret', 'credential', or specific file extensions like '.pem', '.pfx', and '.env'. This behavior is indicative of an attempt to harvest credentials, API keys, or configuration secrets from cloud storage repositories.