Data copied to other location than C drive

Check all created files. That does not have extension ps1, bat or cmd to avoid IT Pro scripts. That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc. This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.