SharePoint File Operation via PowerShell
Detects file access or download operations from Microsoft SharePoint Online where the User-Agent string indicates the use of PowerShell. This behavior has been observed in campaigns by threat groups for bulk data exfiltration.
Microsoft Sentinel (KQL)
