High Volume File Copy to Public/External Shares

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•4

Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.