How do you detect exfiltration to cloud storage?

Combine proxy and endpoint telemetry. At the proxy, alert on large POST or PUT requests to file-sharing domains such as Mega and Dropbox, scoped first to servers and service accounts. On the endpoint, flag non-browser processes connecting to those domains and command-line sync tools. Use a CASB or tenant restrictions to separate your corporate tenant from personal ones. Sequence matters: an archive followed by an unusual upload client followed by sustained POSTs is a high-confidence chain.

Detecting Exfiltration to Cloud Storage Services

Mega, Dropbox, Google Drive and similar services are the most common destinations for staged data in extortion intrusions. The traffic is TLS to a reputable domain, so the signal is not the destination alone. It is who uploads, with what client, how much, and whether the business has any reason to use that service.

Signals at a Glance

Signal	Where	ATT&CK
Upload-sized POST/PUT to a file-sharing domain from a server or service account	Proxy, SWG	T1567.002
Non-browser process connecting to storage provider domains	EDR network events	T1567.002
Command-line sync tool with a cloud remote configured	Process creation	T1567.002
Personal-tenant OneDrive or Drive sign-in from a corporate host	Proxy, CASB	T1567.002
Spike in sanctioned-app uploads to an unmanaged tenant	CASB, API logs	T1537

Proxy and Endpoint Signals

Start with who is allowed to use these services. Servers, domain controllers and service accounts almost never have a legitimate reason to upload to a consumer storage domain. Match on method and body size, not just the domain:

title: Large Upload To Consumer Cloud Storage
logsource:
  category: proxy
detection:
  destination:
    cs-host|endswith:
      - '.mega.nz'
      - '.mega.io'
      - '.dropbox.com'
      - '.dropboxapi.com'
      - '.drive.google.com'
      - '.content.googleapis.com'
      - 'transfer.sh'
      - 'anonfiles.com'
  upload:
    cs-method:
      - 'POST'
      - 'PUT'
  large:
    cs-bytes|gte: 5000000
  condition: destination and upload and large
level: medium
# tune/validate: scope to server subnets and service accounts first, then widen

On the endpoint, the browser is the expected client. Anything else talking to these domains is a lead:

// Microsoft Defender XDR (KQL) - non-browser process reaching storage providers
// tune/validate: extend the browser and sync-client allowlists for your estate
let browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe"]);
let sanctioned = dynamic(["onedrive.exe","dropbox.exe"]);
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteUrl has_any ("mega.nz","mega.io","dropbox.com","dropboxapi.com","drive.google.com")
| where InitiatingProcessFileName !in~ (browsers)
| where InitiatingProcessFileName !in~ (sanctioned)
| summarize conns = count(), firstSeen = min(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
| order by conns desc

Context That Separates Exfil from Work

Tenant awareness: a CASB or SWG that distinguishes your corporate tenant from a personal one turns “uses OneDrive” into “uploads to an unmanaged OneDrive”.
Account type: alert hardest on servers, privileged accounts and hosts with admin tooling recently executed.
Sequence: archive creation, then a credentialed upload tool, then a burst of POSTs is stronger than any one step. See the staging and rclone pages for the first two.
Provider logs: Dropbox Business, Google Workspace and Microsoft 365 audit logs record bulk downloads and external sharing on the sanctioned side of the same problem.

Vetted sources

SigmaHQ proxy and DNS rules for file-sharing domains, Elastic detections for suspicious cloud-sync clients, Microsoft 365 and Google Workspace audit logging, and CASB vendor guidance. Baseline your own environment — marketing and design teams legitimately move large files to these services.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Proxy and Endpoint Signals

Context That Separates Exfil from Work

Build Detections That Fire

Data Exfiltration Detection

Detection Hub

Rclone Exfil Detection