High Volume Access to User Documents or Desktop

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.