SharePoint Audit Log Noise: Platform Activity That Looks Like an Attack
Much of what the Microsoft 365 audit log records as user activity is the platform itself. Twelve patterns that look like exfiltration, password spray or privilege escalation, and what each one really is.