Cloud Storage Upload Burst from a Single Account
Detects a rapid burst of file upload activity to cloud storage applications from a single account, including unusual proxy or device context. This rule identifies scenarios where an account performs 20 or more upload events or uploads 20 or more distinct objects within a 15-minute time window to common cloud storage services like Google Drive, Dropbox, Box, MEGA, OneDrive, or ShareFile. It also highlights if any of these uploads originate from an anonymous proxy.
Microsoft Sentinel (KQL)
