Microsoft 365 - Potential Ransomware Activity Detected by MCAS
Detects when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that are potentially infected with ransomware. This indicates a possible ransomware attack attempting to encrypt or exfiltrate data via cloud storage.
Sigma
