Suspicious Volume of Backup File Creations

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.