Detecting Mass Exfiltration and File Downloads in SharePoint & OneDrive

Data exfiltration can occur via external threat actors who have gained tenant access or malicious insiders preparing to depart the organization. One common indicator of data theft is an abrupt spike in document downloads from SharePoint Online document libraries or OneDrive drives.

Here is how to build an anomalous download detection rule using OfficeActivity logs.

Prerequisites

• Microsoft Sentinel with the Office 365 Data Connector enabled and ingesting SharePoint and OneDrive audit records.

KQL Mass Download Alert Rule

// Detect Abnormal Bulk File Download Activity from SharePoint or OneDrive
let timeRange = 1d;
let downloadThreshold = 50; // Adjust according to enterprise baseline
OfficeActivity
| where TimeGenerated >= ago(timeRange)
| where RecordType in ("SharePointFileOperation", "OneDrive")
| where Operation in~ ("FileDownloaded", "FileAccessed")
| summarize 
    DownloadedFilesCount = count(),
    UniqueFileExtensions = dcount(SourceFileExtension),
    DownloadedFilesSample = make_set(SourceFileName, 25),
    FirstActivity = min(TimeGenerated),
    LastActivity = max(TimeGenerated)
    by UserId, ClientIP, bin(TimeGenerated, 15m)
| where DownloadedFilesCount >= downloadThreshold
| extend DurationMinutes = datetime_diff('minute', LastActivity, FirstActivity)
| project TimeGenerated, UserId, ClientIP, DownloadedFilesCount, UniqueFileExtensions, DurationMinutes, DownloadedFilesSample
| order by DownloadedFilesCount desc

Query Logic Breakdown

• bin(TimeGenerated, 15m): Groups download operations into tight 15-minute intervals. Downloading 50 files over a whole day is normal; downloading 50 files in 15 minutes suggests automated scraping or staging.
• SourceFileExtension: Evaluates diversity of downloaded content (e.g., zip files, PDFs, spreadsheets).
• Sample Aggregation: Captures the first 25 file names via make_set to assist SOC tier 1 analysts in immediate contextual scoping.

Tuning Considerations

• Backup Agents & Sync Clients: OneDrive sync clients (OneDrive.exe) sync folders locally during setup. Inspect UserAgent headers and filter out known corporate device sync engines.

MITRE ATT&CK Mapping

• Tactic: Exfiltration (TA0010), Collection (TA0009)
• Technique: Exfiltration Over Web Service: Cloud Storage (T1567.002), Data Staged: Local Data Staging (T1074.001)