Exfil via Email or Teams using Power Automate (Microsoft Flow)
This rule detects the creation of new Microsoft Power Automate flows that are configured to use connectors capable of exfiltrating data via email or collaboration platforms like Microsoft Teams. It specifically looks for flows created with connectors which could indicate an attempt to send sensitive information outside the organization.
Microsoft Sentinel (KQL)
