Anomalous per-user spike in SharePoint FileAccessed without downloads (stream exfiltration)
This rule detects anomalous, high-volume file access activity within SharePoint by monitoring the 'FileAccessed' operation. It calculates a 14-day rolling baseline for each user and triggers an alert when the hourly 'FileAccessed' count significantly exceeds this baseline, specifically when no corresponding 'FileDownloaded' events are present. This behavior aims to detect stream-based data exfiltration techniques that bypass standard download-based DLP controls.
Microsoft Sentinel (KQL)
