Bulk mailbox archive and file-share collection sweep across shares/mailboxes
Detects a single host or account interacting with a high volume of archive (PST/OST) and document files, or initiating mailbox exports within a short window, which is often indicative of mass data staging and collection prior to exfiltration.
Sigma
