Most Popular Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: Mass SharePoint/OneDrive/Salesforce Download After Helpdesk Identity Reset
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
YARA-L
