Stealer-like process reading KeePass, RDP, VPN, Office and mail files in bulk
Detects a non-system process interacting with a high volume of sensitive files across multiple distinct categories (such as KeePass, RDP, VPN, email, and Office documents) within a short time window, which is indicative of data collection or staging prior to exfiltration.
Microsoft Sentinel (KQL)
