Microsoft 365 scripted SharePoint access
Repeated SharePoint or OneDrive file access from a scripted client — a PowerShell, curl, python or bare-SDK user agent rather than a browser or the sync…
What it detects
Repeated SharePoint or OneDrive file access from a scripted client — a PowerShell, curl, python or bare-SDK user agent rather than a browser or the sync client.
Bulk collection before exfiltration does not look like downloading; it looks like reading, quickly, from something that is not a person. FileDownloaded rules miss it entirely because a script that reads a document library generates FileAccessed, and the user agent is the thing that separates a script walking a site from an employee opening files.
MITRE ATT&CK mapping
False positives and triage
Scripted access to SharePoint is legitimate and common — PnP PowerShell used by administrators, migration and backup tooling, reporting jobs, and any in-house automation over Graph. Baseline the accounts and service principals that do it. The signal is a scripted agent under an ordinary END-USER account (people do not browse SharePoint with curl), access from an IP the account has not used, or breadth across sites the account has no business reason to read — check the site collections touched, not just the volume.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_scripted_sharepoint_access.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_scripted_sharepoint_access
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1567.002, T1213.002]
description: |
Repeated SharePoint or OneDrive file access from a scripted client — a PowerShell,
curl, python or bare-SDK user agent rather than a browser or the sync client.
Bulk collection before exfiltration does not look like downloading; it looks like
reading, quickly, from something that is not a person. `FileDownloaded` rules miss
it entirely because a script that reads a document library generates `FileAccessed`,
and the user agent is the thing that separates a script walking a site from an
employee opening files.
match:
provider: Office365
event_action_any:
- FileAccessed
- FileAccessedExtended
- FileDownloaded
- FilePreviewed
- SearchQueryPerformed
raw_message_contains_any:
- "PowerShell/"
- "python-requests"
- "curl/"
- "Wget/"
- "Go-http-client"
- "axios/"
- "okhttp"
threshold:
count: 10
window_seconds: 600
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Scripted access to SharePoint is legitimate and common — PnP PowerShell used by
administrators, migration and backup tooling, reporting jobs, and any in-house
automation over Graph. Baseline the accounts and service principals that do it. The
signal is a scripted agent under an ordinary END-USER account (people do not browse
SharePoint with `curl`), access from an IP the account has not used, or breadth
across sites the account has no business reason to read — check the site
collections touched, not just the volume.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.