Lesson 151 — The User Downloaded 4 GB of Data Before Resigning

Case briefing

Stage 1 — reconstruct the user's cloud download activity

Start with the user and the relevant Microsoft 365 workloads. Preserve timestamps, operations, file names, sites, client IP and user-agent context.

let TargetUser = "alex.wilson@contoso.com";
OfficeActivity
| where TimeGenerated > ago(7d)
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| project TimeGenerated,
          UserId,
          OfficeWorkload,
          Operation,
          Site_Url,
          SourceFileName,
          SourceRelativeUrl,
          ClientIP,
          UserAgent
| order by TimeGenerated asc

Stage 2 — quantify the download volume

The initial report says “about 4 GB.” Test that claim against the telemetry. Where your audit records expose a usable file-size field, convert it safely and calculate the total.

let TargetUser = "alex.wilson@contoso.com";
OfficeActivity
| where TimeGenerated > ago(7d)
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| extend DownloadBytes = tolong(column_ifexists("FileSize", 0))
| summarize FilesDownloaded=count(),
            TotalBytes=sum(DownloadBytes),
            Sites=dcount(Site_Url),
            FirstDownload=min(TimeGenerated),
            LastDownload=max(TimeGenerated)
          by UserId
| extend TotalGB = round(TotalBytes / 1024.0 / 1024.0 / 1024.0, 2)

Stage 3 — establish the user's normal download baseline

Now step away from the incident day. Look at the preceding 30-day period and calculate the user's normal daily download count.

let TargetUser = "alex.wilson@contoso.com";
OfficeActivity
| where TimeGenerated between (ago(37d) .. ago(7d))
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| summarize DailyDownloads=count() by bin(TimeGenerated, 1d)
| summarize BaselineDays=count(),
            AverageDailyDownloads=round(avg(DailyDownloads), 1),
            MaximumDailyDownloads=max(DailyDownloads),
            MinimumDailyDownloads=min(DailyDownloads)

Stage 4 — investigate where the downloads came from

Group the activity by client IP, user agent and SharePoint site. This helps determine whether the downloads came from familiar access patterns or a new source.

let TargetUser = "alex.wilson@contoso.com";
OfficeActivity
| where TimeGenerated > ago(7d)
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileDownloaded", "FileSyncDownloadedFull")
| summarize Downloads=count(),
            FirstSeen=min(TimeGenerated),
            LastSeen=max(TimeGenerated),
            Files=make_set(SourceFileName, 50)
          by ClientIP, UserAgent, Site_Url
| order by Downloads desc

Stage 5 — build the resignation-day timeline

Finally, place file access, downloads and sharing-related operations around the known resignation time. Chronology helps distinguish ordinary working activity from a concentrated departure sequence.

let TargetUser = "alex.wilson@contoso.com";
let ResignationTime = datetime(2026-08-18 16:30:00);
OfficeActivity
| where TimeGenerated between (ResignationTime - 24h .. ResignationTime + 1h)
| where UserId =~ TargetUser
| where OfficeWorkload in ("SharePoint", "OneDrive")
| where Operation in ("FileAccessed", "FileDownloaded", "FileSyncDownloadedFull",
                       "SharingSet", "AnonymousLinkCreated")
| project TimeGenerated,
          Operation,
          OfficeWorkload,
          Site_Url,
          SourceFileName,
          SourceRelativeUrl,
          ClientIP,
          UserAgent
| order by TimeGenerated asc

Agent Foskett's cloud activity timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft 365 audit telemetry recorded a substantial increase in SharePoint and OneDrive download activity by alex.wilson@contoso.com during the period immediately preceding the user's resignation. The activity was reviewed by timestamp, workload, file operation, site, client IP and user-agent context and compared with an earlier behavioural baseline. The incident-day download pattern materially exceeded the user's recent normal activity and was concentrated within the hours before the recorded resignation time. This supports escalation as unusual pre-departure data collection. The available evidence does not, by itself, establish malicious intent, unauthorised disclosure or successful exfiltration outside the organisation. Further investigation should review the sensitivity of the files, external sharing activity, endpoint evidence, identity telemetry and applicable HR or legal context.

Lesson 151 key takeaways

• Large download volume should be measured and validated rather than accepted from an initial alert or report.
• OfficeActivity can support SharePoint and OneDrive investigations when Microsoft 365 audit data is available in Sentinel.
• Audit schemas can vary by operation, so validate fields before relying on calculated byte totals.
• Preserve file, site, IP, user-agent and operation context.
• Historical behaviour helps distinguish routine downloading from a genuine anomaly.
• A baseline identifies abnormality; it does not establish intent.
• Known devices and corporate IPs do not automatically make bulk data collection legitimate.
• Correlate download activity with sharing operations and identity telemetry.
• Keep HR facts separate from technical telemetry in the final report.
• Write the conclusion at exactly the strength the evidence supports.

Module 13 has begun

Lesson 151 opens a new investigation path. Instead of following malware across an endpoint, Module 13 follows users, sessions and applications through Microsoft 365 and cloud services. Next, the same account appears to access SharePoint from two different countries.