Exfiltration from SharePoint/OneDrive via anonymous proxy infrastructure

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•5

Detects anomalous, high-volume file download activity from SharePoint or OneDrive initiated through identified anonymous proxy services. This behavior suggests potential data exfiltration by an adversary attempting to mask their source IP address while offloading large amounts of data.