Bulk Document Staging into Downloads or Roaming

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•1

Detects a high number of office, PDF, text, and archive files created in Downloads or AppData Roaming by one process within fifteen minutes. This behavior is indicative of data staging prior to exfiltration.