SharePoint Discovery via SearchQueryPerformed indexdocid Pagination

Ibrahim Saud@tektrix

•updated Sep 21, 2026•2•0•11

This rule detects potentially malicious search activity in Microsoft SharePoint by monitoring for high-frequency queries that include specific site class patterns ('STS_Site' or 'STS_Web') and a document ID range search pattern ('indexdocid'). This behavior is characteristic of an adversary attempting to enumerate or scrape documents within a SharePoint environment.