OneDrive/SharePoint bulk data collection correlated with main.exe execution
Detects anomalous OneDrive/SharePoint bulk download activity specifically correlated with execution of the named main.exe process, excluding Microsoft-signed sync clients and known enterprise migration tools (SharePoint Migration Tool, ShareGate).
Microsoft Sentinel (KQL)
