High Volume of Object Close Operations (Event ID 4658)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•9

This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.