Bulk SharePoint/OneDrive/Exchange file exfiltration by single user
Detects high-volume file access or download activity by a single user in SharePoint or OneDrive over a 15-minute window. This behavior is indicative of bulk cloud data exfiltration often associated with extortion campaigns.
YARA-L
