Suspicious OAuth App File Download Activities

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.