Sensitive file access followed by exfil to personal webmail/cloud storage

Ankit Mehta@Secvyn

•updated Sep 28, 2026•1•0•3

This rule detects potential data exfiltration by correlating access to files labeled as sensitive (confidential, restricted, etc.) with a subsequent upload to a personal cloud storage provider or transmission via email to a personal domain within a two-hour window.