Detection of Unauthorized OneDrive and SharePoint Mass Data Downloads

Threat actors are increasingly utilizing OAuth phishing techniques, specifically Device Code Authentication phishing, to compromise user sessions within Microsoft 365 environments. By successfully convincing a user to authorize a malicious OAuth application via device code flow, adversaries gain persistent and valid access tokens. These tokens are subsequently leveraged to perform mass, automated downloads of files from OneDrive for Business and SharePoint Online.

This activity bypasses traditional password-based authentication and MFA, as the attacker effectively becomes the authenticated user within the cloud session. Detection requires identifying anomalous, high-volume file download patterns that deviate from standard enterprise behavior, specifically focusing on sessions established via third-party or unauthorized OAuth application IDs.

Attack Chain

1. Attacker sends a spearphishing email or message prompting the victim to authenticate via a malicious OAuth application using Device Code flow.
2. Victim navigates to the Microsoft device login page and enters the code provided by the attacker-controlled application.
3. Victim authorizes the application, granting the attacker a persistent OAuth access token with Graph API or OneDrive/SharePoint permissions.
4. Attacker uses the stolen access token to authenticate against the Microsoft Graph API or OneDrive/SharePoint endpoints.
5. Attacker enumerates file paths and directory structures within the victim's OneDrive or SharePoint site to identify sensitive data.
6. Attacker initiates automated, high-volume file downloads (typically >25 unique files in a short time window) to exfiltrate data.
7. Data is transferred to attacker-controlled infrastructure over legitimate web service protocols.

Impact

Successful exfiltration results in the compromise of sensitive corporate data stored in cloud repositories. The use of OAuth tokens allows for stealthy persistence and the potential for lateral movement within the M365 environment, potentially leading to further account takeovers or the compromise of additional cloud-resident data.

Recommendation

• Deploy the provided ESQL detection rule to identify users or applications performing mass file downloads from OneDrive/SharePoint.
• Review Entra ID sign-in logs for sessions established using the deviceCode protocol that correlate with high-volume download activity.
• Audit existing OAuth application consents and revoke permissions for any unauthorized or unnecessary third-party applications.
• Enforce Conditional Access policies to restrict OAuth authentication to trusted devices and known enterprise applications.
• Educate users on the risks of Device Code Authentication phishing and promote the use of Microsoft Defender for Office 365 Safe Links.