Bulk SharePoint/OneDrive/Exchange Collection via Graph API

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

This rule detects potentially malicious or automated data access patterns within Microsoft 365 or similar cloud environments. It identifies user accounts or applications that exhibit a high volume of file/email access operations across a diverse set of paths, which is often indicative of automated data exfiltration, scraping, or suspicious collection by a compromised identity.