High Volume File Uploads to SharePoint/OneDrive
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
Microsoft Sentinel (KQL)
