High-volume file exfil via anonymous proxy across SP/OD/Exchange

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects anomalous, high-volume file access (downloading, accessing, or previewing) in cloud applications that originates from an IP address identified as an anonymous proxy. This behavior is indicative of potential data exfiltration or unauthorized mass data collection.