Abnormal Large Cloud File Download Activity Detected

Ankit Mehta@Secvyn

•updated Jun 4, 2026•4•0•11

This rule detects an abnormal volume of large file downloads or exports from cloud applications, excluding SharePoint, OneDrive, and Teams. It identifies instances where a single account downloads or exports more than 3 files with an average size greater than 10 MB within an hour from a specific application and IP address. This behavior could indicate data exfiltration or unauthorized data access.