Suspicious OAuth App File Download Activities from SharePoint/OneDrive

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•53

Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.