Agent Foskett Investigation • Data Exfiltration • OneDrive Sync • SharePoint • Microsoft Defender XDR • KQL
The File Was Never Downloaded — It Was Synchronised
The investigators searched for bulk downloads.
Nothing unusual appeared.
No 4GB browser download. No obvious file-transfer spike. No malware alert.
But thousands of company files had still arrived on the user's device.
The files were never downloaded one by one.
OneDrive had synchronised the library.
Cloud Data Investigation
The hunt was correct. The assumption was wrong.
Do not hunt only for downloads
Inspect OneDrive and SharePoint sync activity
Correlate cloud activity with endpoint evidence
The download hunt returned almost nothing
The security team asked a reasonable question: did the user download a large amount of company data? The problem was that the data had moved without matching the behaviour they were looking for.
No obvious bulk downloadThe expected browser-based download spike was not present in the first review.
Legitimate Microsoft clientOneDrive was an approved application performing a normal business function.
The files still movedA SharePoint library had been synchronised to the endpoint, placing large numbers of files within local reach.
The clue was the question nobody had asked
Instead of asking only “what was downloaded?”, Agent Foskett asked “how else could the files have reached the device?”
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
Bulk browser download: Not found OneDrive client: Active SharePoint library: Recently synchronised
Start by inspecting the user's cloud activity
CloudAppEvents can expose useful Microsoft 365 activity, but action names and available fields vary by workload and tenant. Begin broadly and inspect the data before building a narrow hunt.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
CloudAppEvents
| where Timestamp > ago(30d)
| where AccountDisplayName == "Alex Morgan"
| project Timestamp,
Application,
ActionType,
ObjectName,
IPAddress,
RawEventData
Discover the activity names before filtering
A download-only filter can hide the very behaviour you need. Look at the action types associated with SharePoint and OneDrive, then identify the events that represent file access, synchronisation or related activity in your own tenant.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
CloudAppEvents
| where Timestamp > ago(30d)
| where AccountDisplayName == "Alex Morgan"
| summarize Events = count()
by Application, ActionType
| order by Events desc
Search for sync-related behaviour
After inspecting the available action names, broaden the hunt beyond the word “download”. The following is a discovery query, not a promise that every tenant uses these exact values.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
CloudAppEvents
| where Timestamp > ago(30d)
| where AccountDisplayName == "Alex Morgan"
| where Application has_any ("OneDrive", "SharePoint")
| where ActionType has_any ("sync", "file", "access")
| project Timestamp, Application, ActionType,
ObjectName, IPAddress
| order by Timestamp asc
Now check the endpoint
Cloud evidence tells you what happened in Microsoft 365. Endpoint telemetry can help establish whether the OneDrive client was active and what happened around the same time.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
DeviceProcessEvents
| where Timestamp > ago(30d)
| where AccountName =~ "alex.morgan"
| where FileName =~ "OneDrive.exe"
| project Timestamp, DeviceName, AccountName,
FileName, ProcessCommandLine
| order by Timestamp asc
Correlate the cloud and device timelines
The strongest finding is not simply that OneDrive ran. It is that OneDrive activity, SharePoint access and local file activity occurred together during the period being investigated.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
DeviceFileEvents
| where Timestamp > ago(7d)
| where DeviceName == "LAPTOP-042"
| where FolderPath has "OneDrive"
| summarize FileEvents = count(),
FirstSeen = min(Timestamp),
LastSeen = max(Timestamp)
by FolderPath
| order by FileEvents desc
The important distinction: access method versus outcome
A browser download and a synchronised library use different mechanisms, but the security question is the same: did sensitive company data move somewhere it should not have?
Do not over-trust event namesAn investigation built around one expected action can miss another legitimate feature that produces the same security outcome.
Follow the dataAsk where the files started, where they appeared and what process or cloud activity connects those points.
Preserve contextSync activity can be entirely legitimate. User role, device ownership, timing, data sensitivity and business purpose determine whether it is suspicious.
Agent Foskett's investigation mindset
Do not search only for the action you expect. Search for every plausible path to the outcome.
Do not ask only: Was it downloaded?The absence of a traditional download event does not prove the data remained in the cloud.
Ask: How could it have moved?Consider sync clients, mapped libraries, browser access, archives, removable media and other paths supported by the evidence.
Ask: What happened next?Once files reach an endpoint, continue into local file activity, archive creation, USB use, browser uploads and other available telemetry.
Investigation findings
The first query did not fail. It answered a question that was too narrow.
No bulk browser download was foundThe original hunt accurately showed that the expected download pattern was absent.
Synchronisation changed the pictureOneDrive and SharePoint activity provided another plausible path for large-scale file movement.
Endpoint evidence completed the timelineCloud activity became more meaningful when correlated with OneDrive process activity and local file events.
Related Agent Foskett investigations
Continue with data movement, cloud activity, insider risk and endpoint investigations.
The User Downloaded 4GB of Data Before ResigningInvestigate abnormal SharePoint and OneDrive volume before an employee departure.
The User Shared The File With EveryoneInvestigate excessive sharing and risky access to cloud-hosted data.
The USB Drive Was Never Meant To Be FoundInvestigate removable media as another possible data movement path.
The Browser Uploaded The File At 2:17AMFollow endpoint and browser evidence when data leaves through a web session.
KQL Threat Hunting GuideBuild practical hunting queries for Microsoft security investigations.
Agent Foskett AcademyBuild practical KQL and Microsoft security investigation skills through structured lessons.
Final thought
Security investigations become fragile when the query is built around one assumed method instead of the outcome you are trying to explain.
The first query was not wrongIt correctly showed that the expected bulk download was not there.
The investigation was too narrowSearching only for downloads ignored another legitimate Microsoft 365 mechanism capable of moving the same data.
Follow outcomes, not assumptionsIf the evidence says the files moved, keep investigating until you understand how.
