Mass Downloads in the last 7 days

Description

This query looks for mass downloads identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.

Query · kql

let lookback = 7d; //set the period to query let threshold = 50; //set the threshold for number of downloads let downloadTimeframe = 5m; //set the bin timeframe to group the events CloudAppEvents | where ActionType == "FileDownloaded" and Timestamp > ago(lookback) // Filter to only "Download" actions | summarize DownloadCount=count() by AccountDisplayName, AccountObjectId, bin(Timestamp,downloadTimeframe) //bin the results into a timeframe by the account | where DownloadCount > threshold //filter the records that don't meet the threshold | project AccountDisplayName,AccountObjectId,DownloadCount
Raw source Mass Downloads in the last 7 days · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: a1b2c3d4-e5f6-4g7h-8i9j-k0l1m2n3o4p5
name: Mass Downloads in the last 7 days
description: |
  This query looks for mass downloads identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Exfiltration
relevantTechniques:
- T1020
query: >
  let lookback = 7d; //set the period to query
  let threshold = 50; //set the threshold for number of downloads
  let downloadTimeframe = 5m; //set the bin timeframe to group the events
  CloudAppEvents
  | where ActionType == "FileDownloaded" and Timestamp > ago(lookback) // Filter to only "Download" actions
  | summarize DownloadCount=count() by AccountDisplayName, AccountObjectId, bin(Timestamp,downloadTimeframe) //bin the results into a timeframe by the account
  | where DownloadCount > threshold //filter the records that don't meet the threshold
  | project AccountDisplayName,AccountObjectId,DownloadCount
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: ObjectGuid
        columnName: AccountObjectId
      - identifier: DisplayName
        columnName: AccountDisplayName
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.