AN1160
Analytic 1160
Windows
Programmatic or excessive access to file shares, SharePoint, or database repositories by users not typically interacting with them. This includes abnormal access by privileged accounts, enumeration of large numbers of files, or downloads of sensitive content in bursts.
WinEventLog:Security
EventCode=5145
m365:unified
Accessed SharePoint files or pages
[UserContext]
Privileged users may be excluded if they routinely perform admin actions on SharePoint or file shares.
[AccessVolumeThreshold]
The number of files accessed or pages retrieved in a short window to flag as abnormal.
[TimeWindow]
The time range (e.g., 5 minutes, 1 hour) in which burst access patterns are considered anomalous.
AN1161
Analytic 1161
Linux
Command-line tools (e.g., curl, rsync, wget, or custom Python scripts) used to scrape documentation systems or internal REST APIs. Unusual access patterns to knowledge base folders or shared team drives.
auditd:SYSCALL
execve of curl, rsync, wget with internal knowledge base or IPs
linux:Sysmon
EventCode=3, 22
[CommandRegex]
Regex matching internal doc servers, knowledge base paths, or IP patterns.
[TimeWindow]
Burst access of repositories over a short time window.
AN1162
Analytic 1162
SaaS
Abuse of SaaS platforms such as Confluence, GitHub, SharePoint Online, or Slack to access excessive internal documentation or export source code/data. Includes use of tokens or browser automation from unapproved IPs.
saas:confluence
access.content
saas:slack
Exported file or accessed admin API
[APIUsageThreshold]
Number of API calls or files accessed before triggering detection.
[KnownSafeIPs]
Whitelist of internal IPs/users that may be excluded from detection.
AN1163
Analytic 1163
macOS
Access of mounted cloud shares or document repositories via browser, terminal, or Finder by users not typically interacting with those resources. Includes script-based enumeration or mass download.
macos:unifiedlog
access to /Volumes/SharePoint or network mount
macos:osquery
curl, python scripts, rsync with internal share URLs
[AccessedMountPath]
Paths to sensitive volumes may differ based on org setup.
[UserGroup]
Expected user groups that typically access shared data.