This is a new-terms detection rule targeting first-time usage of two Windows endpoint data-transfer tools that abuse cloud storage: AzCopy (copy/sync) to Azure Blob/Data Lake/File storage and Azure Storage Explorer. The rule triggers when a host, within a 7-day history window, runs AzCopy with a copy or sync operation against SAS-authenticated Azure Storage endpoints (e.g., blob.core.windows.net, dfs.core.windows.net) or launches Storage Explorer. While these utilities are legitimate, ransomware operators often leverage them to exfiltrate data to attacker-controlled cloud storage or to move data between victim and attacker accounts. The alert fires once per host per history window; repeated use on the same host within the window does not re-alert until the history window expires. The rule ingests data from multiple sources (process events from CrowdStrike, Windows Sysmon-based process events, M365 Defender, and Windows logs) and correlates process details such as command_line, executable paths, and associated identifiers to identify the pertinent activity. It includes triage guidance to verify the utility, inspect command lines for --from-to parameters and SAS hostnames, determine source/destination, compare process metadata and signatures, and correlate with cloud-storage operations (GetBlob/PutBlob/ListBlobs) and related SIEM detections. False positives include authorized migrations or first-time Storage Explorer use by trusted users. Remediation steps include isolating the host, revoking SAS tokens and keys, identifying exfiltrated data, removing staged binaries, and hunting for additional related activity across hosts.