A first-time SSN DLP trigger alongside a large SharePoint/OneDrive file movement, read against the full 767-event record and resolved into a quantified two-sided verdict.
Four behavior rules clustered on one user: an Exchange DLP match on possible US SSN content, a burst of OneDrive/SharePoint uploads, repeated file access, and the sign-in context around them.
767 events across SharePoint, Exchange and Azure AD — 207 uploads, 205 downloads, 82 mailbox accesses, full OneDrive syncs, and a single site-collection admin grant.
The shape fits data staging and it fits ordinary remote-employee sync. Three checks separate the two, and none of them are in the record as captured.
User john.smith triggered an Exchange DLP policy for US SSN content for the first time in 30 days (ML_NEW_USER) while moving a large volume of files through SharePoint/OneDrive — 207 uploads, 205 downloads, full OneDrive syncs — which also raised a bandwidth anomaly. Eighty-two mailbox accesses and a single SharePoint site-collection admin grant occurred in the same window. Sign-ins came over consumer ISPs (T-Mobile, Comcast) from two US cities.
The behavioural shape is consistent with data staging and egress, but it is equally consistent with ordinary OneDrive sync by a remote employee.
The evidence does not support escalation on its own, and it does not support closure either. Three checks decide it: external-sharing activity in the window, the site-collection admin grant, and whether the two-geo login is concurrent or sequential.
The case arrived with an AI triage comment (validation: true, actionable: true). It assessed a first-time SSN DLP trigger with multiple SharePoint/OneDrive uploads and accesses, and flagged three anomalies: first-seen SSN DLP for this user in 30 days, multiple file uploads, multiple file accesses.
It found no contradiction between the alert and the events, but noted that missing IP and location context limits investigation. No mitigation was applied. It left five open questions — user intent, whether the activity fits the user's job, any external exposure, DLP follow-up and education, and possible account compromise.
The analysis below extends that triage with the full record composition, an ATT&CK mapping, the detection gaps, and the quantified two-sided verdict it did not provide.
| Tactic | Technique | Driver (signal / activity) | Basis |
|---|---|---|---|
| Initial Access | T1078.004 Cloud Accounts | O365_AzureAD_UserLoggedIn over T-Mobile + Comcast, 2 cities, Chrome/Win10 | Signature + activity |
| Priv. Escalation | T1098.003 Additional Cloud Roles | SiteCollectionAdminAdded (1) — SharePoint admin grant in-window | Activity |
| Collection | T1530 Data from Cloud Storage | 205 FileDownloaded + O365_SharePoint_FileAccessed_Multiple | Signature + activity |
| Collection | T1114 Email Collection | 82 MailItemsAccessed (Audit.Exchange) | Activity |
| Exfiltration | T1567.002 Exfil to Cloud Storage | 207 FileUploaded + FileSyncUploadedFull + BANDWIDTH_ANOMALY | Signature + activity |
| Sensitive data | O365_DLP_Policy_SSN | Exchange DLP — possible US SSN content (ALERT_POLICY) | Signature |
767 events in the capture window.
SharePoint 65% · Exchange 34% of the 767 events. Ink tints carry series only — no colour encoding.
| Element | Detail from the record |
|---|---|
| Identity | john.smith@acme.example (named employee) |
| Sign-in | Chrome / Windows 10 · OAuth2:Authorize · 7 logins |
| Networks | ISPs T-Mobile USA & Comcast; ActorIPs 2607:fb91:802:1645:…, 2601:152:4f80:8420:… (IPv6) |
| Geo | Cities Metro A & Metro B, United States (~1,300 mi apart, same window) |
| Risk flags | ALERT_POLICY · ML_NEW_USER · BANDWIDTH_ANOMALY · FILE_DOWNLOAD |
| Notable single events | 1× SiteCollectionAdminAdded · 4× DLPRuleMatch · FileSyncUploadedFull/DownloadedFull |
| DLP event gap | Exchange DLP hit carried no IP / city / country (__undefined) |
| Behavior rule | Sub-score | Risk flags | What it caught |
|---|---|---|---|
| O365_DLP_Policy_SSN | 4,400 | ALERT_POLICY ML_NEW_USER | Exchange DLP match on possible US SSN; first-seen for this user |
| O365_SharePoint_OneDrive_FileUploaded_Multiple | 1,000 | ALERT_POLICY BANDWIDTH_ANOMALY | Burst of uploads to OneDrive/SharePoint |
| O365_SharePoint_FileAccessed_Multiple | 200 | FILE_DOWNLOAD ALERT_POLICY | Repeated file access/download over ~5.5h |
| O365_AzureAD_UserLoggedIn | 0 | — | Sign-in context (ISP / city / device) |
Detection gaps surfaced by this case.
SiteCollectionAdminAdded fired in-window but isn't its own detection. An admin grant during a DLP or bulk-move event is a priority escalation signal.
No rule checks AnonymousLinkCreated or external-recipient activity. Its absence is the strongest benign signal here; surfacing it either way would resolve the exfiltration concern fast.
205 downloads and full syncs only rolled into the generic FileAccessed rule. The bandwidth anomaly fired, but no MB figure is surfaced.
82 MailItemsAccessed beside an Exchange SSN match; no rule correlated whether SSN data was emailed out.
Metro A (TX) and Metro B (MD) in one 6h window. An Azure AD impossible-travel correlation would separate compromise from a dual-homed mobile worker.
The DLP event's IP, city and country were __undefined. The Fluency AI triage flagged this exact blind spot.
Query the window for external and anonymous sharing, and external mail recipients, on john.smith's SharePoint and Exchange activity. None found is strongly benign.
Establish who was granted SiteCollectionAdmin on which site, and by whom.
Confirm whether the Metro A and Metro B sign-ins are concurrent (impossible travel) or sequential mobile and home use.
Evidence is preserved in scenario scn-n5gkgzkuueww4 for detection testing against the gaps above.
Source. Read-only analysis via the Fluency MSSP MCP (get_case full record and create_scenario_from_case capture summary, 767 sanitized events).
Mapping basis. MITRE ATT&CK tactics and techniques are inferred from the firing signatures and observed O365 operations — the signature catalog carries no formal ATT&CK tags.
Verdict. Likelihoods are an analyst estimate from the evidence present and are not a Fluency output.
Identity. Preserved per MCP redaction policy. Case username_john.smith@acme.example_20260529, tenant acme. Sanitized for external sharing — customer and tenant names, users, hostnames and domains replaced with training identities; IPs, hashes, CVE and technique IDs and event IDs preserved as IOCs.
Generated 5 June 2026.