Lesson 153 — Hundreds of Files Were Downloaded in Eleven Minutes

Case briefing

Stage 1 — isolate the eleven-minute download burst

Start with the narrowest useful time window. Preserve operation, workload, file, site, IP and user-agent context for every download event.

let TargetUser = "alex.wilson@contoso.com";
let StartTime = datetime(2026-08-18 14:00:00);
let EndTime = StartTime + 11m;
OfficeActivity
| where TimeGenerated between (StartTime .. EndTime)
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| project TimeGenerated,
          UserId,
          Operation,
          OfficeWorkload,
          Site_Url,
          SourceFileName,
          SourceRelativeUrl,
          ClientIP,
          UserAgent
| order by TimeGenerated asc

Stage 2 — measure download velocity minute by minute

Aggregate the events into one-minute bins. This turns a long event list into a simple picture of how quickly the activity accelerated and whether it remained sustained.

let TargetUser = "alex.wilson@contoso.com";
let StartTime = datetime(2026-08-18 14:00:00);
let EndTime = StartTime + 11m;
OfficeActivity
| where TimeGenerated between (StartTime .. EndTime)
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| summarize Downloads=count(),
            UniqueFiles=dcount(SourceFileName),
            Sites=dcount(Site_Url)
          by bin(TimeGenerated, 1m)
| order by TimeGenerated asc

Stage 3 — identify what generated the burst

Group the activity by operation, IP address, user agent and site. This helps determine whether one consistent client produced the downloads or whether several access patterns were involved.

let TargetUser = "alex.wilson@contoso.com";
let StartTime = datetime(2026-08-18 14:00:00);
let EndTime = StartTime + 11m;
OfficeActivity
| where TimeGenerated between (StartTime .. EndTime)
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| summarize Downloads=count(),
            UniqueFiles=dcount(SourceFileName),
            FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated)
          by Operation, ClientIP, UserAgent, Site_Url
| order by Downloads desc

Stage 4 — compare velocity with historical behaviour

Now calculate download counts in ten-minute windows across an earlier baseline period. Compare the incident burst with the user's normal short-window activity rather than only comparing daily totals.

let TargetUser = "alex.wilson@contoso.com";
OfficeActivity
| where TimeGenerated between (ago(37d) .. ago(7d))
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| summarize Downloads=count() by bin(TimeGenerated, 10m)
| summarize WindowsObserved=count(),
            AverageDownloadsPer10m=round(avg(Downloads), 1),
            MaximumDownloadsPer10m=max(Downloads),
            P95DownloadsPer10m=percentile(Downloads, 95)

Stage 5 — reconstruct the activity around the burst

Expand slightly before and after the eleven-minute window and include file access and sharing operations. This helps determine what led into the burst and what happened immediately afterwards.

let TargetUser = "alex.wilson@contoso.com";
let StartTime = datetime(2026-08-18 13:50:00);
let EndTime = datetime(2026-08-18 14:25:00);
OfficeActivity
| where TimeGenerated between (StartTime .. EndTime)
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileAccessed", "FileDownloaded",
                       "FileSyncDownloadedFull", "SharingSet",
                       "AnonymousLinkCreated")
| project TimeGenerated,
          Operation,
          OfficeWorkload,
          Site_Url,
          SourceFileName,
          ClientIP,
          UserAgent
| order by TimeGenerated asc

Agent Foskett's download-velocity timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft 365 audit telemetry recorded hundreds of SharePoint and OneDrive download events associated with alex.wilson@contoso.com during an approximately eleven-minute period. The activity was analysed by minute, unique file count, workload, operation, site, client IP and user-agent context and compared with an earlier short-window behavioural baseline. The incident window materially exceeded the user's normal download velocity, supporting the conclusion that high-speed data collection occurred. The available telemetry should be used to determine whether the burst was produced by legitimate synchronisation, interactive downloading or another mechanism. High download velocity alone does not establish malicious intent or prove that organisational data was transferred outside Microsoft 365.

Lesson 153 key takeaways

• Total download volume and download velocity answer different investigation questions.
• Use narrow time windows when the suspicious burst is already known.
• Bin events into short intervals to expose the shape of high-speed activity.
• Compare event count with unique-file count.
• Keep browser and synchronisation operations distinguishable.
• Group activity by IP, user agent and site to investigate the mechanism.
• Build short-window historical baselines rather than relying only on daily totals.
• Statistical outliers identify unusual behaviour, not malicious intent.
• Investigate activity immediately before and after the burst.
• Prove data collection and data disclosure as separate parts of the investigation.

Module 13 — the cloud investigation deepens

Lesson 151 established unusual data volume. Lesson 152 added geographic inconsistency. Lesson 153 now proves that the collection occurred at unusually high speed. Next, we pivot away from file activity and investigate a different form of cloud persistence: an OAuth application granted consent.