Connections to Cloud Storage, File-Sharing and Paste Services
Flags endpoints associated with anonymous file-drop sites, paste services and chat platforms commonly abused for exfiltration and C2. Domains are matched with term-based has_any, which avoids the substring false positives of contains (e.g. t.me matching client.messaging.adobe, or file.io matching sharefile.io). Sanctioned services (Dropbox, Google Drive, OneDrive/SharePoint, Box) are intentionally left out to keep volume manageable; an optional block is included.
Microsoft Sentinel (KQL)
