huntrule

Microsoft 365 SecurityComplianceCenter: Exfiltration Activity to Unsanctioned Apps

Alerts on successful Cloud App Security reports of data exfiltration attempts using unsanctioned apps.

FreeReviewedSigma · Medium · v4
Product
m365
Service
threat_management
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-08-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Exfiltration

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags successful Microsoft Cloud App Security events where an activity matches an attempt to exfiltrate information and the destination app is not sanctioned. Attackers may use unapproved SaaS or web apps to move data outside approved channels while blending into normal user activity. The detection relies on SecurityComplianceCenter telemetry, specifically events sourced from SecurityComplianceCenter with the eventName 'Data exfiltration to unsanctioned apps' and status marked as success.

Reporting behind it

Related detections9 linkedT1537 — drag to rearrange
Suspicious S3 Bucket Replication Configured via Scattered Spider Exfiltration Technique
Suspicious AWS Instance Access or Export via SSH Key or Export Task
Suspicious Container Image Export via ctr in Cloud Model Exfiltration
Suspicious AWS Transfer Family Server Creation for Data Exfiltration (via cloudtrail)
Suspicious EC2 Snapshot Attribute Modification for External Sharing via CloudTrail
Suspicious Cross-Project Compute Snapshot Creation via GCP Audit
Suspicious Compute Disk IAM Policy Modification Granting Owner Role via GCP Audit
Suspicious EBS Snapshot Shared With External Account via CloudTrail
Suspicious GCP Bucket Deletion for Namespace Hijacking (via gcp)
Microsoft 365 SecurityComplianceCenter: Exfiltration Activity to Unsanctioned Apps
Pivot detection · T1537 · 9 related

Changelog

v4
  1. v4
    Candidate ingested via manual entry.2026-07-31
  2. v3
    Candidate ingested via manual entry.2026-07-31
  3. v2
    Candidate ingested via manual entry.2026-07-31
  4. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.