Potential Data Exfiltration or Encryption via Cloud Storage Tools
This rule detects the execution of suspicious executables ('servertool.exe', 'encrypt.exe') when their command line arguments contain references to common cloud storage services (OneDrive, SharePoint, GoogleDrive, Dropbox, iCloud). This pattern could indicate an attempt to exfiltrate data to cloud storage or encrypt data for impact, potentially as part of a ransomware attack.
Microsoft Sentinel (KQL)
