High Volume M365 Cross-Service Operations from Single IP

nomit vyas@xoxo

•updated Jun 24, 2026•7•0•6

Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window from a single identity and IP address. This behavior can indicate data exfiltration or reconnaissance by an adversary.