Microsoft 365 storage services exfiltration activity

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: Azure Audit Log OR Microsoft Graph Logs
Detection Modules	Cloud
Detector Tags	Microsoft Graph Activity Logs
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Low

Description

The Microsoft Graph API was used to download Microsoft OneDrive and SharePoint files.

Attacker's Goals

To extract sensitive information stored in Microsoft 365 storage services.

Investigative actions

• Determine which items were downloaded and whether they contained any sensitive information.
• Investigate the identity following actions.