Data Exfiltrated to OneDrive Cloud Storage

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects potential data exfiltration to OneDrive cloud storage. It specifically looks for HTTP PUT requests to onedrive.live.com or graph.microsoft.com with a URI containing '/content' and a data size greater than 10000 bytes. This combination suggests a large file upload to OneDrive.