Suspicious Large File Operations

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•3

This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.