Large File Copy Activity Detected

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•2

This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.