Rapid Sign-In-to-SharePoint Exfiltration Cycle Indicating Automated Helix Tooling
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
Microsoft Sentinel (KQL)
