High Volume File Uploads to SharePoint/OneDrive

Ankit Mehta@Secvyn

•updated Jun 13, 2026•1•0•5

This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.