SharePoint Document Library Bulk Download

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential bulk downloads from SharePoint document libraries. It triggers when a client makes 30 or more HTTP requests to a SharePoint API endpoint related to web lists ('/_api/web/lists') within a 60-second window. This behavior can indicate an attempt to exfiltrate a large amount of data from SharePoint.