High-volume automated SharePoint/OneDrive/Exchange data collection

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects high-volume, automated file download or access activity originating from SharePoint Online, OneDrive, or Exchange Online within a 2-hour window. The rule identifies suspicious patterns involving a large number of distinct file events, potentially indicating automated scripts or tools (like python-httpx) performing mass data collection or exfiltration.