TI map Email entity to SharePoint sharing outside the organization
This rule detects instances where a SharePoint or OneDrive file/folder is shared with a guest user whose email address is identified as a threat intelligence indicator. This could indicate an attempt to exfiltrate data to a known malicious entity or an account compromise being used for data staging.
Microsoft Sentinel (KQL)
