Low-and-Slow Cloud Data Exfiltration Across Multiple Days

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

This rule detects anomalous, high-volume file access or download activity across cloud applications and file storage services. It tracks users over a period of time, flagging individuals whose daily activity consistently contributes to a large total volume of data access (exceeding 500MB) over at least five days, specifically looking for sustained behavior that deviates from sudden, single-day spikes.