High-volume automated SharePoint/OneDrive/Exchange data collection via Graph

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•2

This rule detects anomalous, high-volume file and email access events by a single user from a single IP address within the Microsoft 365 environment. The detection logic groups operations such as file downloads, file access, and mailbox item access, flagging instances where a user performs 100 or more such operations, which may indicate data exfiltration or compromised account activity.