High-Volume File Exfiltration via Anonymous Proxy (SharePoint/OneDrive/Exchange)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•5•0•2

Detects high-volume or large-size file access, download, or preview activity originating from known anonymous proxy IP addresses. This behavior is indicative of potential data exfiltration or unauthorized scraping of sensitive documents from cloud storage.