M365 Threat Management: Suspicious OAuth App File Downloads from SharePoint or OneDrive
Alerts on unusual bulk file downloads by a Microsoft 365 OAuth app from SharePoint or OneDrive.
FreeReviewedSigma · Medium · v4
- Product
- m365
- Service
- threat_management
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-23
- Updated
- 2026-07-31
What it detects
This rule flags successful events where Microsoft Cloud App Security reports an OAuth app downloading multiple files from Microsoft SharePoint or Microsoft OneDrive in a way that is unusual for the user. Such activity can indicate token misuse or unauthorized access as an attacker leverages OAuth permissions to exfiltrate data. Detection relies on threat management telemetry from SecurityComplianceCenter, matching the specific “Suspicious OAuth app file download activities” success event.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
microsoft-365-suspicious-oauth-app-file-downloads-from-sharepoint-onedrive-ee111937
title: "M365 Threat Management: Suspicious OAuth App File Downloads from SharePoint or OneDrive"
id: 50b6284f-219a-4462-933d-a0e3b897808d
status: test
description: This rule flags successful events where Microsoft Cloud App Security reports an OAuth app downloading multiple files from Microsoft SharePoint or Microsoft OneDrive in a way that is unusual for the user. Such activity can indicate token misuse or unauthorized access as an attacker leverages OAuth permissions to exfiltrate data. Detection relies on threat management telemetry from SecurityComplianceCenter, matching the specific “Suspicious OAuth app file download activities” success event.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
- attack.exfiltration
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Suspicious OAuth app file download activities
status: success
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: ee111937-1fe7-40f0-962a-0eb44d57d174
type: derived