Microsoft employs enough people that they can afford to have one team scanning for unusual ingress/egress traffic patterns while others work on troubleshooting. If not, they should not be shedding 60k employees right now.