Agent Foskett Investigation • Data Exfiltration • SharePoint • OneDrive • Microsoft Defender XDR • KQL
The User Downloaded 4GB of Data Before Resigning
The user had not triggered an impossible travel alert.
MFA was still working.
No malware was detected.
The account behaved like a legitimate employee account.
But three days before resigning, the download volume changed completely.
Cloud Data Investigation
The identity looked normal. The volume did not.
Establish the user's normal activity baseline
Find sudden download spikes
Correlate data activity with the resignation timeline
Nothing looked obviously malicious
That was exactly why the activity was easy to miss.
Legitimate identityThe account belonged to a real employee and authentication activity appeared consistent with normal business use.
No malware alertNo malicious executable, script or endpoint detection explained the activity.
Normal tools, abnormal volumeSharePoint and OneDrive were being used exactly as designed, but the amount of data being accessed had changed dramatically.
The first clue was not a file—it was the baseline
A single download can be normal. A sudden change from tens of megabytes to gigabytes is much more interesting.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
Typical daily download activity: 20 MB - 50 MB Three days before resignation: 4.2 GB Authentication alerts: None
Start with the user's cloud activity
CloudAppEvents can provide useful visibility into activity from connected cloud applications. Action names and available fields can vary, so inspect your tenant data before relying on one exact value.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 8
- 9
CloudAppEvents
| where Timestamp > ago(30d)
| where AccountDisplayName == "Alex Morgan"
| project Timestamp,
Application,
ActionType,
ObjectName,
IPAddress,
RawEventData
Find the actions that represent file access
Do not assume the exact action name. First inspect the tenant and identify the values associated with downloads, file access and sync activity.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
CloudAppEvents | where Timestamp > ago(30d) | where AccountDisplayName == "Alex Morgan" | summarize Events = count() by Application, ActionType | order by Events desc
Build a daily activity baseline
Once the relevant actions are understood, compare the user against their own normal behaviour rather than relying only on a fixed threshold.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
CloudAppEvents
| where Timestamp > ago(30d)
| where AccountDisplayName == "Alex Morgan"
| where ActionType has "download"
| summarize DownloadEvents = count()
by bin(Timestamp, 1d)
| order by Timestamp asc
Count is useful. Volume is better.
If the event payload exposes file size, extract it from the available fields and calculate the amount of data moved. Field names vary, so validate the schema in your tenant first.
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
CloudAppEvents
| where Timestamp > ago(30d)
| where AccountDisplayName == "Alex Morgan"
| where ActionType has "download"
| extend FileSizeBytes = tolong(RawEventData.FileSize)
| summarize DownloadedBytes = sum(FileSizeBytes),
DownloadEvents = count()
by bin(Timestamp, 1d)
| extend DownloadedGB = round(DownloadedBytes / 1024.0 / 1024.0 / 1024.0, 2)
| order by Timestamp asc
What the investigator should correlate
The volume is the clue. Context determines whether it is expected business activity or possible exfiltration.
Resignation timelineCompare the activity with the notice date, last working day and any change in responsibilities or access requirements.
Files and locationsIdentify which SharePoint sites, OneDrive locations, folders and documents were accessed.
Normal historical behaviourCompare the current spike with the same user's previous activity, not just the behaviour of other employees.
Sign-in contextReview IP addresses, device identity, session details, location and authentication evidence around the same period.
Business justificationLarge downloads can be legitimate during project handover, archive work or travel preparation. The business context matters.
Follow-on movementLook for USB activity, archive creation, browser uploads or other events that may explain where the data went next.
Why this investigation is difficult
The behaviour can be risky without being technically malicious.
The user was authorisedThe employee may have had legitimate permission to every file they accessed.
No exploit was requiredData can leave an organisation through normal cloud applications without malware, privilege escalation or suspicious code execution.
The timeline changed the meaningThe same activity that might look routine during a project can become significant immediately before resignation.
Agent Foskett's investigation mindset
Do not hunt only for malware. Hunt for changes in behaviour.
Do not ask only: Was the sign-in malicious?A legitimate sign-in can still lead to risky or inappropriate data access.
Ask: What changed?Compare activity against the user's own history and identify sudden deviations in volume, timing or resource access.
Ask: Where did the data go?Follow the investigation beyond the download event into endpoint, browser, USB and cloud activity where telemetry is available.
Investigation findings
The account did not look compromised. The behaviour still deserved investigation.
The identity was legitimateThe account, device and authentication evidence did not initially indicate an external attacker.
The baseline exposed the anomalyA major increase in file access became visible only when activity was compared over time.
The timeline created contextThe unusual activity occurred shortly before resignation, making the download spike materially more significant.
Related Agent Foskett investigations
Continue with identity, cloud activity, persistence and data movement investigations.
The User Shared The File With EveryoneInvestigate excessive sharing and risky access to cloud-hosted data.
The VPN Login Continued After The Exit MeetingFollow access that continued after an employee had left the organisation.
The USB Drive Was Never Meant To Be FoundInvestigate removable media as part of a data movement timeline.
The Login Came Through A Trusted DeviceSee why a familiar device does not automatically make subsequent activity safe.
KQL Threat Hunting GuideBuild practical hunting queries for Microsoft security investigations.
Agent Foskett AcademyBuild practical KQL and Microsoft security investigation skills through structured lessons.
Final thought
Not every data exfiltration investigation begins with malware, a failed sign-in or an obvious alert.
The tools were legitimateSharePoint and OneDrive behaved normally from a technical perspective.
The behaviour was not normalThe sudden increase in download activity broke the user's established pattern.
The timeline made it evidenceWhen unusual data movement coincides with resignation, the investigation should not stop at a successful sign-in.
