Bulk Document Staging into Downloads or Roaming
Detects a high number of office, PDF, text, and archive files created or renamed in the Downloads or AppData Roaming folders by a single process within a fifteen-minute window. The detection is triggered if either 25 or more files are created/renamed, or if the total size of these files exceeds 500 MB.
Microsoft Sentinel (KQL)
