Bulk SharePoint/OneDrive File Access via Scripting User Agents
Detects high-volume file access or download operations in SharePoint or OneDrive performed by common scripting libraries and client user agents, which may indicate automated data exfiltration.
Sigma
