detect-archive-exfiltration-to-competitor

This query can be used to detect instances of a malicious insider creating a file archive and then emailing that archive to an external "competitor" organization.