BlackFile\UNC6671\Cordial Spider High Volume M365 Cross Service Operations

Lacey Cochrane@NullVectorX

•updated Jun 20, 2026•6•0•17

Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window. This behavior can indicate data exfiltration or collection by an adversary.