Multi-stage cloud attack infrastructure rotation (auth→recon→exfil)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•1

Detects a multi-stage sequence of network connections to Microsoft cloud services (login.microsoftonline.com, graph.microsoft.com, and data exfiltration endpoints like sharepoint.com) consistent with Storm-3121/Storm-3032 adversary activity. This rule is designed for IDS/IPS monitoring of traffic patterns indicating authentication, reconnaissance, and potential data exfiltration from Microsoft 365 environments.