Suspicious File Export Activity

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•4

This rule detects suspicious file export activity by monitoring for the creation of files with names containing keywords like 'export', 'dump', or 'extract'. It triggers an alert if five or more such files are created by the same account within a one-hour window, indicating potential data exfiltration or staging.