Recursive PDF and Microsoft 365 Document Enumeration for Exfiltration Staging
Detects the use of command-line tools employing recursive search patterns (e.g., -Recurse) targeting document file extensions (PDF, DOCX, XLSX). This activity is often associated with the staging phase of an exfiltration attempt, where an adversary identifies sensitive files across a directory structure before collection.
Cortex XDR
