Data Exfiltration to Unsanctioned Apps via Microsoft Cloud App Security
Detects when Microsoft Cloud App Security identifies a user or IP address using an unsanctioned application to perform activities resembling data exfiltration from the organization. This rule specifically triggers on 'Data exfiltration to unsanctioned apps' events with a 'success' status from the SecurityComplianceCenter event source.
Sigma
