Confirmed Data Exfiltration to Personal Email by Company Employees
This rule identifies emails sent from an internal employee email address to external personal email domains where the recipient's local part of the email address contains tokens from the sender's display name for more than 0 words matching. It also analyses attachments for sensitive keywords (e.g., 'confidential', 'secret') and assigns a risk score based on factors like email volume, attachment count, and presence of sensitive attachments. This could indicate an attempt to exfiltrate sensitive company data to a personal account. It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
Microsoft Sentinel (KQL)
