SharePoint & OneDrive Automation Data Exfiltration

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•5

Detects programmatic file downloads from SharePoint and OneDrive using automation tools like PowerShell, PnP, Graph SDK, Python, Node.js, or generic CLI tools (curl, wget) rather than typical browser access. This can indicate data exfiltration.