Microsoft 365 Suspicious OAuth App File Downloads from SharePoint/OneDrive

title: Microsoft 365 Suspicious OAuth App File Downloads from SharePoint/OneDrive
id: 50b6284f-219a-4462-933d-a0e3b897808d
status: test
description: This rule flags Microsoft Cloud App Security events where an OAuth app successfully downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a pattern that is unusual for the user. Unusual bulk file downloads by an OAuth app can indicate automated collection of data for exfiltration or unauthorized access. Detection relies on threat management telemetry from the SecurityComplianceCenter event source and on the specific “Suspicious OAuth app file download activities” success events.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.exfiltration
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Suspicious OAuth app file download activities
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ee111937-1fe7-40f0-962a-0eb44d57d174
    type: derived