OneDrive bulk file download shortly after device-code sign-in
Detects high volumes of file download operations from OneDrive or SharePoint occurring within one hour of a device-code authentication event. This pattern is indicative of potential data exfiltration by an adversary using a stolen access token obtained via an OAuth device-code phishing attack.
Microsoft Sentinel (KQL)
