Suspicious Creation of Multiple Database-Related Files

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•5

This rule detects when a single process account creates 5 or more files containing 'database', 'db', or '.sql' in their filenames within a one-hour window. This could indicate an attempt to stage, exfiltrate, or manipulate database files.