Recursive OneDrive Discovery by a Command Interpreter
Detects recursive listing or search commands targeting OneDrive directories from a shell or script interpreter. This activity could indicate an attacker attempting to discover sensitive files within a user's OneDrive.
Microsoft Sentinel (KQL)
