Large 'logs.dat' File Creation in User Directories
Detects the creation or modification of a large file named 'logs.dat' (100KB or greater) within common user-related directories such as AppData, Temp, Users, or Documents. This pattern can indicate data staging for exfiltration, where an adversary collects sensitive information into a single file before attempting to move it off the system.
Microsoft Sentinel (KQL)
