BlackFile\UNC6671\Cordial Spider SharePoint & OneDrive Automation Data Exfil

Lacey Cochrane@NullVectorX

•updated Jun 20, 2026•6•0•12

This rule detects programmatic file downloads from SharePoint and OneDrive using various automation tools and SDKs, rather than typical browser access. It specifically looks for `FileDownloaded`, `FileSyncDownloadedFull`, `FileAccessed`, or `FilePreviewed` operations within SharePoint or OneDrive audit logs where the user agent string indicates the use of PowerShell, PnP, Microsoft Graph SDK, Python, Node.js, or common command-line tools like curl or wget. This behavior can be indicative of data exfiltration.