Most Popular ShinyHunters 2026 Detection: Mass SharePoint or OneDrive File Access Following Anomalous Okta Sign-In
Detects a burst of file access or download operations from SharePoint or OneDrive by a single user account within a short timeframe. This behavior is indicative of bulk data collection or exfiltration, often associated with post-credential-theft activity where an attacker stage and extract organizational data.
Sigma
