Microsoft 365 SecurityComplianceCenter: Exfiltration Activity to Unsanctioned Apps

Alerts on successful Cloud App Security reports of data exfiltration attempts using unsanctioned apps.

FreeReviewedSigma · Medium · v4

Product: m365
Service: threat_management
Author: Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2021-08-23
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1537Transfer Data to Cloud Account
Impact

What it detects

This rule flags successful Microsoft Cloud App Security events where an activity matches an attempt to exfiltrate information and the destination app is not sanctioned. Attackers may use unapproved SaaS or web apps to move data outside approved channels while blending into normal user activity. The detection relies on SecurityComplianceCenter telemetry, specifically events sourced from SecurityComplianceCenter with the eventName 'Data exfiltration to unsanctioned apps' and status marked as success.

Reporting behind it

Related detections9 linkedT1537 — drag to rearrange

Suspicious S3 Bucket Replication Configured via Scattered Spider Exfiltration Technique

Suspicious AWS Instance Access or Export via SSH Key or Export Task

Suspicious Container Image Export via ctr in Cloud Model Exfiltration

Suspicious AWS Transfer Family Server Creation for Data Exfiltration (via cloudtrail)

Suspicious EC2 Snapshot Attribute Modification for External Sharing via CloudTrail

Suspicious Cross-Project Compute Snapshot Creation via GCP Audit

Suspicious Compute Disk IAM Policy Modification Granting Owner Role via GCP Audit

Suspicious EBS Snapshot Shared With External Account via CloudTrail

Suspicious GCP Bucket Deletion for Namespace Hijacking (via gcp)

Microsoft 365 SecurityComplianceCenter: Exfiltration Activity to Unsanctioned Apps

Pivot detection · T1537 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

microsoft-365-cloud-app-security-successful-data-exfiltration-to-unsanctioned-ap-2b669496

title: "Microsoft 365 SecurityComplianceCenter: Exfiltration Activity to Unsanctioned Apps"
id: 039d731e-1b63-4ed1-b8d3-57199e1af4ee
status: test
description: This rule flags successful Microsoft Cloud App Security events where an activity matches an attempt to exfiltrate information and the destination app is not sanctioned. Attackers may use unapproved SaaS or web apps to move data outside approved channels while blending into normal user activity. The detection relies on SecurityComplianceCenter telemetry, specifically events sourced from SecurityComplianceCenter with the eventName 'Data exfiltration to unsanctioned apps' and status marked as success.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1537
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Data exfiltration to unsanctioned apps
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2b669496-d215-47d8-bd9a-f4a45bf07cda
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL