High Volume File Moves to Cloud Storage Folders

Ankit Mehta@Secvyn

•updated Jun 30, 2026•3•0•6

This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.