Multiple JSON File Creations/Modifications in Package Folder

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.