Most Popular Detection 2026: Mass Cloud Storage Download/Exfiltration by Single Identity
Detects anomalous high-volume download or 'GetObject' operations from a single identity across multiple cloud storage objects and buckets within a short time window, which is indicative of bulk data exfiltration.
Microsoft Sentinel (KQL)

