Large Microsoft 365 File Download Sequence by One Account
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
Microsoft Sentinel (KQL)

