Bulk SharePoint file download following discovery query enumeration

Ankit Mehta@Secvyn

•updated Sep 10, 2026•0•0•1

Detects anomalous user behavior where a file search query is followed by a high volume of file downloads within a short period (30 minutes) from the same IP address. This behavior is indicative of an attacker searching for sensitive documents and performing bulk extraction or exfiltration.