SharePoint Bulk Document Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a high volume of document downloads from SharePoint, specifically looking for repeated access to the `/_layouts/download.aspx` URI. A threshold of 30 downloads within 60 seconds from a single source IP address triggers the alert. This behavior could indicate an attempt to exfiltrate a large amount of data from SharePoint.