All Detections

Large Data Transfer to Removable Media

avatar
Darshan Thummar@Mighty
updated Jun 13, 2026006

Detects large data transfers to removable storage media for physical exfiltration

Microsoft Sentinel (KQL)