Anomalous Cloud Upload Volume — Exfiltration via Trusted Services
This hunting query detects potential data exfiltration by identifying users whose outbound data volume to cloud storage and messaging platforms: (OneDrive, Dropbox, Google Drive, SharePoint, Telegram) spikes dramatically compared to their own historical behavior. It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes. MITRE ATT&CK Mapping Tactic: Exfiltration (TA0010) Technique: T1567 – Exfiltration Over Web Service Sub-technique T1567.002 – Exfiltration to Cloud Storage Data Source DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema) Logic Breakdown: Baseline window (31 days, excluding the most recent day): The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user. Global peer baseline fallback: For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users. Today's upload volume: Sums BytesSent to the same destination patterns over the last 24 hours per user. Ratio comparison: Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline. Alert conditions (both must be true): UploadRatio > 5 — today's upload is more than 5x the user's normal daily average. TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high. Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
Microsoft Sentinel (KQL)
