Multiple Failed OneDrive File Downloads via Microsoft Graph API

Google SecOps@GoogleSecOps

•updated Feb 24, 2025•0•49

This rule detects multiple failed attempts (401 Unauthorized status) to download the same file from OneDrive via the Microsoft Graph API. This behavior may indicate a permissions issue for the user attempting the download or could be an indicator of an adversary attempting to access unauthorized files.