Repeated Large File Transfers via Email
This detection identifies repeated outbound email events where large files are sent multiple times within a specific time window. It helps uncover potential data exfiltration attempts or misuse of corporate email for transferring large files externally. Thresholds for file size, frequency, and time window can be adjusted to fit organizational context.
Microsoft Sentinel (KQL)
