SharePoint wildcard document listing with contentindexdocid pagination

Ankit Mehta@Secvyn

•updated Sep 10, 2026•1•0•2

This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.