Rapid bulk file access from Desktop folder consistent with Millenium RAT desktop-grab command
Detects high-frequency file creation, modification, or renaming activity within the user's Desktop directory. This pattern is often associated with ransomware activity, automated data exfiltration tools staging files, or malicious droppers unpacking payloads.
Microsoft Sentinel (KQL)
