Anomalous per-user M365 download/export volume vs 30-day baseline

Duo Tech@duotech

•updated Aug 7, 2026•4•1•12

Detects anomalous spikes in per-user M365 (SharePoint and Exchange) activity volume by comparing current 15-minute intervals against a 30-day rolling baseline (mean + 3 standard deviations). This behavior may indicate mass data staging or exfiltration activities common in precursor phases of extortion or data theft.