Bulk SharePoint Download Activity
Details: Detection to identify bulk download of files from SharePoint within a short period of time (defined as >= 5000 files downloaded within 10 minutes). Hypothesis: Adversaries may collect large volumes of sensitive data for exfiltration from cloud storage services such as SharePoint. This is a common technique employed by data extortion focused groups such as ShinyHunters. Recommended Actions: Conduct review of files downloaded paying particular attention to anything which may be of sensitive nature and could be used for extortion purposes. Ensure files downloaded align with user's role. It may be necessary to confirm activity with user if deemed anomalous. Reference: https://reliaquest.com/blog/threat-spotlight-shinyhunters-fast-tracks-saas-access-subdomain-impersonation/
Microsoft Sentinel (KQL)
