Sustained Low-and-Slow Sub-Threshold Cloud Data Exfiltration

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•2

Detects users accessing files across SharePoint, OneDrive, or Exchange over a sustained period of at least 6 hours, while maintaining a low-to-moderate frequency (1-999 events per hour). This behavioral pattern may indicate slow, automated data exfiltration or unauthorized reconnaissance of sensitive files while attempting to stay under traditional volume-based alerting thresholds.