Multiple Backup/Export/Dump File Creations

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.