HYBE breach: hackers got in through a vendor's document-preview tool
https://sockanalyst.com/patch-now/hybe-vendor-doc-preview-breach

Splunk
index=web (uri_path="*preview*" OR uri_path="*viewer*" OR uri_path="*docview*")
| bin _time span=10m
| stats count dc(uri) as docs by _time, src_ip, user, dest
| where docs > 50

Sentinel
// Bulk document reads through preview/viewer endpoints (W3C IIS or WAF logs)
W3CIISLog
| where csUriStem has_any ("preview","viewer","docview")
| summarize Requests=count(), Docs=dcount(csUriStem) by bin(TimeGenerated,10m), cIP, csUserName
| where Docs > 50