Outlook Calendar Attachment Download of file0.txt via Graph API

Duo Tech@duotech

•updated Jul 21, 2026•0•0•2

Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.