M365 Bulk Data Exfiltration via Hosted Infrastructure or Scripted User Agent

Lacey Cochrane@NullVectorX

•updated 8 days ago•9•0•16

Detects high-volume Exchange and SharePoint activity from a single identity where the source originates from hosted or datacenter infrastructure, residential proxies, or scripting user agents, indicative of automated bulk data exfiltration by threat actors like Helix.