Low-and-slow sustained file/mailbox collection under hourly threshold

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

Detects anomalous, low-volume data access behavior within cloud applications (such as file downloads, previews, or mail access) that is sustained over an extended period. This pattern often indicates slow, deliberate data exfiltration designed to evade volume-based detection thresholds.