Mass File Creation on External USB Drive

Renzo L@Renz0x

•updated 12 days ago•8•0•12

Detects a high volume of file creation events (greater than 200 files) on an external USB mount session by a non-system account, which may indicate potential data exfiltration or staging to removable media.