O365 Exfiltration via Excessive File Download

This analytic detects when an excessive number of files are downloaded from Office 365 by the same user over a short period of time. Office 365 may bundle these files together as a ZIP file, however each file will have its own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.