High Volume File Creation/Modification on Removable Media

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•7

This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.