Office365 - Mass Email Attachment Download
This detection looks for cases where a user has downloaded an attachment from 3 or more separate emails over a 24 hour period. This activity could indicate an insider risk collecting documents prior to data exfiltration. The limit for this can be altered based on baseline company behaviour.
Microsoft Sentinel (KQL)
