SharePoint Site Contents Enumerated for Data Theft
This rule detects when a client makes repeated HTTP requests to the SharePoint download.aspx page, specifically looking for the URI pattern "/_layouts/download.aspx". This behavior, when occurring frequently from a single source, could indicate an attempt to enumerate and potentially exfiltrate content from a SharePoint site. The rule uses a threshold of 20 requests within 60 seconds from the same source IP to trigger an alert, suggesting a bulk download or enumeration activity.
Suricata
