
The owner of the OneDrive folder receives no notifications that this is happening. When a new file is added (can also be done for updates), the flow connects to a personal Dropbox folder and copies the file contents.

The flow starts with a trigger that monitors a OneDrive folder. The usage of Power Automate for live off the land techniques came to the forefront recently when Microsoft research found advanced threat actors in a large multinational organization using it to automate the exfiltration of data, which went undetected for 213 days. The more they researched, the more amazed they were with what was possible once they had basic, unprivileged Office 365 access. When Vectra security researchers started dissecting Office 365 security, Power Automate quickly caught their eye. Bet you’re already imagining the things you can do… Living off the land in Office 365 Think of Power Automate as an interconnected system of legos-you can connect one or more actions to create a limitless variety of flows based on your needs. There are also an equal number, if not more, of premium connectors available to purchase as well making countless possibilities. Power Automate is on by default in all O365 tenants and comes standard with about 150 connectors.
