Emails Sent To Personal Emails
This detection looks at emails being sent from a users company email address to their personal email through comparing the sender and recipient email addresses to see if they contain similar strings. Users who are close to leaving the company and working their notice period etc should be monitored more closely and an increased number of emails being sent to a personal email can indicate data exfiltration.
Microsoft Sentinel (KQL)
