ATT&CK T1567 - Exfiltration to Cloud Storage: OneDrive

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP PUT requests to onedrive.live.com with a body size greater than 5000 bytes. This behavior is indicative of data exfiltration to OneDrive cloud storage, aligning with MITRE ATT&CK technique T1567.