Bulk SharePoint/M365 file access via scripting-library UAs exceeding user baseline
Detects anomalous, high-volume access, download, or synchronization activity in SharePoint or OneDrive within a one-hour window. The rule focuses on non-interactive user agents typically used by scripting libraries (e.g., Python requests, PowerShell, Go-http-client) and flags activity that exceeds an individual user's 21-day rolling baseline, suggesting potential automated data exfiltration or mass collection.
Microsoft Sentinel (KQL)
