Browser Token Exfil: purview.microsoft.com Session Followed by First-Seen External Domain

Ankit Mehta@Secvyn

•updated Aug 11, 2026•13•2•2

This rule detects potentially suspicious data exfiltration activities by identifying a pattern where a user authenticates or interacts with the Microsoft Purview service, followed closely (within 15 minutes) by a connection to an external domain that the organization has not established a historical communication pattern with in the last 30 days. This behavior may indicate an adversary is attempting to exfiltrate session tokens or sensitive data to an external server.