Detect Data Exfiltration via Malicious Power Automate Flow with External HTTP/Email Egress in Sumo Logic CSE
Microsoft Power Automate (Flow) lets any licensed user build automations that trigger on events such as new mail, new SharePoint files or a schedule, and then forward the content to an arbitrary destination through the HTTP connector, an external mail recipient, or a personal cloud storage connector (Dropbox, Google Drive, personal OneDrive). An adversary holding a compromised M365 session, or an insider, can create a flow that continuously copies every new file or mail matching a filter to an attacker-controlled webhook or external mailbox. Because the transfer originates from Microsoft's own cloud infrastructure, no process, endpoint network connection or proxy log exists on the victim's side, so EDR and network-egress detections are blind. Detection depends on the M365 Unified Audit Log Power Automate events (CreateFlow, EditFlow, ChangeFlowOwner, PutConnection, CreateConnection) and on Entra ID context for the creating user. This detection flags flow creation or edits by users who have not historically created flows, bursts of flow and connection creation, and flows created from unmanaged IPs.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
_sourceCategory=o365/management/activity
| json field=_raw "Operation", "UserId", "ClientIP", "ObjectId" nodrop
| where Operation in ("CreateFlow", "EditFlow", "ChangeFlowOwner", "CreateConnection", "PutConnection")
| timeslice 1d
| count as Ops, values(Operation) as OpTypes, values(ObjectId) as Targets by UserId, ClientIP, _timeslice
| where Ops >= 10Sumo Logic search over Office 365 Management Activity API logs for Power Automate flow and connection create/edit operations, aggregated per user per day with a 10-operation burst threshold.
Data Sources
Required Tables
False Positives & Tuning
- Business-process automation owners legitimately building flows that post to approved partner or vendor HTTP endpoints
- IT-sanctioned integrations (CRM, ticketing, e-signature) built by citizen developers with external connectors
- Approved flows that email reports to external customers on a schedule
Other platforms for THREAT-Exfiltration-PowerAutomateFlowDataEgress
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Create Test Power Automate Flow with HTTP Action
Expected signal: Unified Audit Log: Operation=CreateFlow with UserId and ClientIP of the test account.
- Test 2 Bulk Flow Creation Simulation
Expected signal: 10 CreateFlow audit events for the same UserId within minutes.
- Test 3 Add External Email Action Flow Edit
Expected signal: Unified Audit Log: Operation=EditFlow for the test UserId.
Response Playbook
Triage
- Pull the flow definition from the Power Platform admin center (or Get-AdminFlow) and identify the trigger (new mail, new file, recurrence) and every action, paying special attention to HTTP, 'Send an email (V2)' to external domains, and personal-cloud connectors.
- Identify the destination: an HTTP action URL pointing at an unfamiliar webhook, request-catcher or tunnel domain, or a mail recipient outside the tenant, is a high-confidence exfiltration indicator.
- Determine the scope of data the trigger covers: which mailbox, SharePoint site or library, and how sensitive it is.
- Check whether the creating user normally builds flows and whether the action came from a managed device and expected IP (Entra ID sign-in logs).
- Review flow run history to confirm whether runs succeeded and roughly how much data left.
- Check the user for HR flags such as resignation or a performance plan, and for recent suspicious sign-ins or MFA changes.
Containment
- Turn off the flow and, if confirmed malicious, delete it; suspend the associated connections.
- Revoke the user's refresh tokens and reset credentials if account compromise is suspected.
- Apply a Power Platform DLP policy blocking the HTTP connector and consumer connectors in the affected environment.
- Block the destination domain at the proxy and DNS layers and notify the owner of the exposed data.
- Search the tenant for other flows sharing the same destination or created by the same actor.
Evidence Collection
- Export the flow definition JSON, run history and connection references before deletion.
- Preserve Unified Audit Log records for CreateFlow, EditFlow, CreateConnection and related operations for the user.
- Preserve Entra ID sign-in logs for the creating session.
- Capture the destination URL or mailbox and any flow run output logs.
Escalation Criteria
- !Flow forwards to an external HTTP endpoint or non-corporate mailbox and has successful runs
- !Source data includes regulated, customer or executive content
- !Flow created from an anomalous IP, unmanaged device or by a recently compromised account
- !Multiple users show flows with the same destination
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Unified Audit Log: CreateFlow, EditFlow, ChangeFlowOwner, CreateConnection, PutConnection, with UserId and ClientIP - >
Power Platform admin center flow inventory and run history - >
Flow definition JSON containing HTTP action URIs and connector references - >
Entra ID sign-in logs for the creating session - >
Power Platform DLP policy configuration and change history
Tuning Guidance
Allowlist known automation owners and service accounts that build flows as part of a sanctioned process. Enforce a Power Platform DLP policy that blocks the HTTP connector in the default environment; remaining hits then become high fidelity. Raise severity when the flow creation IP is not in corporate ranges or the user is flagged as departing.
Hunting Queries
30-day baseline of Power Automate builders in the tenant. Use it to build an allowlist of legitimate citizen developers and to spot users whose flow activity is new.
OfficeActivity
| where TimeGenerated > ago(30d)
| where Operation in ("CreateFlow", "EditFlow", "CreateConnection")
| summarize Ops=count(), Days=dcount(bin(TimeGenerated, 1d)) by UserId
| sort by Ops descindex=o365 sourcetype="o365:management:activity" (Operation=CreateFlow OR Operation=EditFlow OR Operation=CreateConnection)
| stats count as Ops, dc(date_mday) as Days by UserId
| sort - OpsAtomic Red Team Tests
Creates a benign test flow in a lab tenant that posts a static payload to a test HTTP endpoint, generating CreateFlow and CreateConnection audit events. Use a non-sensitive lab tenant only.
Command
Add-PowerAppsAccount; New-AdminFlow -EnvironmentName (Get-AdminPowerAppEnvironment -Default).EnvironmentName -DisplayName 'df00tech-test-flow' -FlowDefinition (Get-Content .\df00tech-flow.json -Raw)Cleanup
Get-AdminFlow -FlowName <flow-id> | Remove-AdminFlowExpected Telemetry
Unified Audit Log: Operation=CreateFlow with UserId and ClientIP of the test account.
Expected Detection
FirstTimeFlowBuilder signal fires for an account with no prior flow activity; burst signal requires 10+ operations.
Creates 10 benign test flows in rapid succession to exceed the burst threshold.
Command
1..10 | ForEach-Object { New-AdminFlow -EnvironmentName (Get-AdminPowerAppEnvironment -Default).EnvironmentName -DisplayName "df00tech-test-flow-$_" -FlowDefinition (Get-Content .\df00tech-flow.json -Raw) }Cleanup
Get-AdminFlow | Where-Object DisplayName -like 'df00tech-test-flow-*' | Remove-AdminFlowExpected Telemetry
10 CreateFlow audit events for the same UserId within minutes.
Expected Detection
FlowCreationBurst / NewBuilderBurst signal fires once 10 operations are seen in 24 hours.
Edits an existing lab test flow to add a Send an email (V2) action addressed to an external test mailbox, producing an EditFlow audit event.
Command
Set-AdminFlow -EnvironmentName (Get-AdminPowerAppEnvironment -Default).EnvironmentName -FlowName <flow-id> -FlowDefinition (Get-Content .\df00tech-flow-external-mail.json -Raw)Cleanup
Get-AdminFlow -FlowName <flow-id> | Remove-AdminFlowExpected Telemetry
Unified Audit Log: Operation=EditFlow for the test UserId.
Expected Detection
EditFlow is counted toward the burst threshold and the first-time builder signal; review the flow definition for the external recipient.