High Volume Outbound Attachment Activity to External Recipients
Detects a sender transmitting many attachment-bearing messages or a large aggregate attachment volume to external recipients within thirty minutes. This could indicate data exfiltration or a compromised account being used to send spam or malware.
Microsoft Sentinel (KQL)
