Multiple Sensitive File Creations by a Single Account

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•6

Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.