GIFTEDCROOK Mass Document Collection by Non-Office Process (T1005)
Detects a process that is not a standard office, browser, or system application accessing a high volume of document files (doc, docx, pdf, xlsx, xls, pptx, txt, odt) within user directories over a short time window. This behavior is indicative of potential automated file collection or data staging by unauthorized processes.
CQL
