Exfiltration to Suspicious Cloud Storage or File Sharing Services
This rule detects outbound network connections to a predefined list of suspicious cloud storage and file-sharing services. These services are often used by adversaries for exfiltration of collected data, providing a covert channel due to their common use and potential for SSL/TLS encryption. The rule specifically looks for `RemoteUrl` containing any of the domains listed in `suspiciousexfildomains`.
Microsoft Sentinel (KQL)
