High-Volume / Scripted SharePoint-OneDrive File Access (Treat FileAccessed = FileDownloaded)

Ankit Mehta@Secvyn

•updated Aug 7, 2026•5•0•3

This rule detects high-volume file access or download operations in SharePoint or OneDrive, performed by non-browser user agents (e.g., Python, PowerShell, cURL, Go). An elevated volume of such actions within a short timeframe is indicative of automated, scripted interaction, which may represent malicious data exfiltration, automated content scraping, or potential account compromise.