High Volume File Creation/Copy to Removable Media

Ankit Mehta@Secvyn

•updated Jun 13, 2026•1•0•4

This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.