Automated Bulk Data Collection via Microsoft Graph SharePoint/OneDrive/Exchange

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•5

Detects high-volume, automated access and download activity targeting sensitive data within Microsoft 365 services (SharePoint, OneDrive, and Exchange) using the Microsoft Graph API. The rule identifies suspicious patterns of URI access associated with file downloading and mail item access, which may indicate automated data exfiltration by an adversary using compromised credentials or OAuth tokens.